1 2025-05-23 Release Manager 2 3 * GCC 14.3.0 released. 4 5 2024-11-20 David Malcolm <dmalcolm (a] redhat.com> 6 7 Backported from master: 8 2024-07-04 David Malcolm <dmalcolm (a] redhat.com> 9 10 PR analyzer/115724 11 * kf.cc (register_known_functions): Add __error_alias and 12 __error_at_line_alias. 13 14 2024-11-20 David Malcolm <dmalcolm (a] redhat.com> 15 16 Backported from master: 17 2024-05-03 David Malcolm <dmalcolm (a] redhat.com> 18 19 PR analyzer/111475 20 * analyzer.cc (is_special_named_call_p): Add "look_in_std" param. 21 (is_std_function_p): Make non-static. 22 * analyzer.h (is_special_named_call_p): Add optional "look_in_std" 23 param. 24 (is_std_function_p): New decl. 25 * engine.cc (stmt_requires_new_enode_p): Look for both "signal" 26 and "std::signal". 27 * kf.cc (register_known_functions): Add various "std::" copies 28 of the known functions. 29 * known-function-manager.cc 30 (known_function_manager::~known_function_manager): Clean up 31 m_std_ns_map_id_to_kf. 32 (known_function_manager::add_std_ns): New. 33 (known_function_manager::get_match): Also look for known "std::" 34 functions. 35 (known_function_manager::get_by_identifier_in_std_ns): New. 36 * known-function-manager.h 37 (known_function_manager::add_std_ns): New decl. 38 (known_function_manager::get_by_identifier_in_std_ns): New decl. 39 (known_function_manager::m_std_ns_map_id_to_kf): New field. 40 * sm-file.cc (register_known_file_functions): Add various "std::" 41 copies of the known functions. 42 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle 43 "std::realloc". 44 * sm-signal.cc (signal_unsafe_p): Consider "std::" copies of the 45 functions as also being async-signal-unsafe. 46 (signal_state_machine::on_stmt): Consider "std::signal". 47 48 2024-08-01 Release Manager 49 50 * GCC 14.2.0 released. 51 52 2024-07-19 Daniel Bertalan <dani (a] danielbertalan.dev> 53 54 Backported from master: 55 2024-07-12 Daniel Bertalan <dani (a] danielbertalan.dev> 56 57 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): 58 Change NULL to nullptr. 59 (struct null_assignment_sm_context): Likewise. 60 * infinite-loop.cc: Likewise. 61 * infinite-recursion.cc: Likewise. 62 * varargs.cc (va_list_state_machine::on_leak): Likewise. 63 64 2024-07-18 David Malcolm <dmalcolm (a] redhat.com> 65 66 Backported from master: 67 2024-05-15 David Malcolm <dmalcolm (a] redhat.com> 68 69 PR analyzer/114899 70 * access-diagram.cc 71 (written_svalue_spatial_item::get_label_string): Bulletproof 72 against SSA_NAME_VAR being null. 73 74 2024-05-07 Release Manager 75 76 * GCC 14.1.0 released. 77 78 2024-04-12 Stefan Schulze Frielinghaus <stefansf (a] linux.ibm.com> 79 80 * region-model.cc (region_model::check_region_size): Bail out 81 early on function pointers. 82 83 2024-04-10 David Malcolm <dmalcolm (a] redhat.com> 84 85 PR analyzer/114472 86 * access-diagram.cc (bit_size_expr::maybe_get_formatted_str): 87 Reject attempts to print sizes that are too large. 88 * region.cc (region_offset::calc_symbolic_bit_offset): Use a 89 typeless svalue for the bit offset. 90 * store.cc (bit_range::intersects_p): Replace assertion with 91 test. 92 (bit_range::exceeds_p): Likewise. 93 (bit_range::falls_short_of_p): Likewise. 94 95 2024-04-10 David Malcolm <dmalcolm (a] redhat.com> 96 97 * infinite-loop.cc: Include "diagnostic-format-sarif.h". 98 (infinite_loop::to_json): New. 99 (infinite_loop_diagnostic::maybe_add_sarif_properties): New. 100 101 2024-04-10 David Malcolm <dmalcolm (a] redhat.com> 102 103 * infinite-recursion.cc: Include "diagnostic-format-sarif.h". 104 (infinite_recursion_diagnostic::maybe_add_sarif_properties): New. 105 106 2024-04-10 David Malcolm <dmalcolm (a] redhat.com> 107 108 * call-details.cc: Include "diagnostic-format-sarif.h". 109 (overlapping_buffers::overlapping_buffers): Add params for new 110 fields. 111 (overlapping_buffers::maybe_add_sarif_properties): New. 112 (overlapping_buffers::m_byte_range_a): New field. 113 (overlapping_buffers::byte_range_b): New field. 114 (overlapping_buffers::m_num_bytes_read_sval): New field. 115 (call_details::complain_about_overlap): Pass new params to 116 overlapping_buffers ctor. 117 * ranges.cc (symbolic_byte_offset::to_json): New. 118 (symbolic_byte_range::to_json): New. 119 * ranges.h (symbolic_byte_offset::to_json): New decl. 120 (symbolic_byte_range::to_json): New decl. 121 122 2024-04-10 David Malcolm <dmalcolm (a] redhat.com> 123 124 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size): 125 Add "size_in_bytes" param. 126 (tainted_allocation_size::maybe_add_sarif_properties): New. 127 (tainted_allocation_size::m_size_in_bytes): New field. 128 (region_model::check_dynamic_size_for_taint): Pass size_in_bytes 129 to tainted_allocation_size ctor. 130 131 2024-04-09 Jakub Jelinek <jakub (a] redhat.com> 132 133 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): Fix duplicated 134 words; in in -> in. 135 * program-state.cc (sm_state_map::replay_call_summary): Fix duplicated 136 words in comment; to to -> to. 137 (program_state::replay_call_summary): Likewise. 138 * region-model.cc (region_model::replay_call_summary): Likewise. 139 140 2024-04-05 David Malcolm <dmalcolm (a] redhat.com> 141 142 PR analyzer/114588 143 * access-diagram.cc (access_diagram_impl::access_diagram_impl): 144 Replace hardcoded colors for valid_style and invalid_style with 145 calls to text_art::get_style_from_color_cap_name. 146 147 2024-04-02 David Malcolm <dmalcolm (a] redhat.com> 148 149 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): 150 Guard against null types. 151 * region-model.cc (apply_constraints_for_gswitch): Likewise. 152 153 2024-03-27 David Malcolm <dmalcolm (a] redhat.com> 154 155 PR analyzer/114473 156 * call-summary.cc 157 (call_summary_replay::convert_svalue_from_summary): Assert that 158 the types match. 159 (call_summary_replay::convert_region_from_summary): Likewise. 160 (call_summary_replay::convert_region_from_summary_1): Add missing 161 cast for the deref of RK_SYMBOLIC case. 162 163 2024-03-23 David Malcolm <dmalcolm (a] redhat.com> 164 165 PR analyzer/114408 166 * engine.cc (impl_run_checkers): Free up any dominance info that 167 we may have created. 168 * kf.cc (class kf_ubsan_handler): New. 169 (register_sanitizer_builtins): New. 170 (register_known_functions): Call register_sanitizer_builtins. 171 172 2024-03-22 David Malcolm <dmalcolm (a] redhat.com> 173 174 PR analyzer/112974 175 PR analyzer/112975 176 * sm-taint.cc (taint_state_machine::on_condition): Strip away 177 casts before considering LHS and RHS, to increase the chance of 178 detecting places where sanitization of a value may have happened. 179 180 2024-03-22 David Malcolm <dmalcolm (a] redhat.com> 181 182 * sm-taint.cc: Include "diagnostic-format-sarif.h". 183 (bounds_to_str): New. 184 (taint_diagnostic::maybe_add_sarif_properties): New. 185 (tainted_offset::tainted_offset): Add "offset" param. 186 (tainted_offset::maybe_add_sarif_properties): New. 187 (tainted_offset::m_offset): New. 188 (region_model::check_region_for_taint): Pass offset to 189 tainted_offset ctor. 190 191 2024-03-21 David Malcolm <dmalcolm (a] redhat.com> 192 193 PR analyzer/113619 194 * region-model.cc (region_model::eval_condition): Fix 195 cast-handling from r14-3632-ge7b267444045c5 so that if those give 196 an unknown result, we continue trying the constraint manager. 197 198 2024-03-20 David Malcolm <dmalcolm (a] redhat.com> 199 200 PR analyzer/109251 201 * sm-malloc.cc (deref_before_check::emit): Reject cases where the 202 check is in a loop header within a macro expansion. 203 (deref_before_check::loop_header_p): New. 204 205 2024-03-20 Jakub Jelinek <jakub (a] redhat.com> 206 207 * constraint-manager.cc (test_range, test_constraint_conditions, 208 test_constant_comparisons, test_constraint_impl, test_purging, 209 test_bits): Use integer_zero_node instead of 210 build_zero_cst (integer_type_node) or 211 build_int_cst (integer_type_node, 0) and integer_one_node instead of 212 build_int_cst (integer_type_node, 1). 213 * region-model.cc (region_model::get_store_value, 214 append_interesting_constants, test_array_1, 215 test_get_representative_tree, test_unique_constants, test_assignment, 216 test_stack_frames, test_constraint_merging, test_widening_constraints, 217 test_iteration_1, test_array_2): Likewise. 218 219 2024-03-19 Jakub Jelinek <jakub (a] redhat.com> 220 221 PR analyzer/113505 222 * region-model.cc (get_tree_for_byte_offset, 223 region_model::get_representative_path_var_1, 224 test_mem_ref, test_POINTER_PLUS_EXPR_then_MEM_REF): Use 225 char __attribute__((may_alias)) * as type of MEM_REF second argument. 226 227 2024-03-19 David Malcolm <dmalcolm (a] redhat.com> 228 229 PR analyzer/114286 230 * kf.cc (class kf_atomic_exchange): Reimplement based on signature 231 seen in gimple, rather than user-facing signature. 232 (class kf_atomic_load): Likewise. 233 (class kf_atomic_store): New. 234 (register_atomic_builtins): Register kf_atomic_store. 235 236 2024-03-18 David Malcolm <dmalcolm (a] redhat.com> 237 238 PR analyzer/110902 239 PR analyzer/110928 240 PR analyzer/111305 241 PR analyzer/111441 242 * access-diagram.cc: Include "analyzer/analyzer-selftests.h". 243 (get_access_size_str): Reimplement for conversion of 244 implmementation of bit_size_expr from tree to const svalue &. Use 245 svalue::maybe_print_for_user rather than tree printing routines. 246 (remove_ssa_names): Make non-static. 247 (bit_size_expr::get_formatted_str): Rename to... 248 (bit_size_expr::maybe_get_formatted_str): ...this, adding "model" 249 param and converting return type to a unique_ptr. Update for 250 conversion of implementation of bit_size_expr from tree to 251 const svalue &. Use svalue::maybe_print_for_user rather than tree 252 printing routines. 253 (bit_size_expr::print): Rename to... 254 (bit_size_expr::maybe_print_for_user): ...this, adding "model" 255 param and converting return type to bool. Update for 256 conversion of implementation of bit_size_expr from tree to 257 const svalue &. Use svalue::maybe_print_for_user rather than tree 258 printing routines. 259 (bit_size_expr::maybe_get_as_bytes): Add "mgr" param and convert 260 return type from tree to const svalue *; reimplement. 261 (access_range::access_range): Call strip_types when on region_offset 262 intializations. 263 (access_range::get_size): Update for conversion of implementation 264 of bit_size_expr from tree to const svalue &. 265 (access_operation::get_valid_bits): Pass manager to access_range 266 ctor. 267 (access_operation::maybe_get_invalid_before_bits): Likewise. 268 (access_operation::maybe_get_invalid_after_bits): Likewise. 269 (boundaries::add): Likewise. 270 (bit_to_table_map::populate): Add "mgr" param and pass it to 271 access_range ctor. 272 (access_diagram_impl::access_diagram_impl): Pass manager to 273 bit_to_table_map::populate. 274 (access_diagram_impl::maybe_add_gap): Use svalue rather than tree 275 for symbolic bit offsets. Port to new bit_size_expr 276 representation. 277 (access_diagram_impl::add_valid_vs_invalid_ruler): Port to new 278 bit_size_expr representation. 279 (selftest::assert_eq_typeless_integer): New. 280 (ASSERT_EQ_TYPELESS_INTEGER): New. 281 (selftest::test_bit_size_expr_to_bytes): New. 282 (selftest::analyzer_access_diagram_cc_tests): New. 283 * access-diagram.h (class bit_size_expr): Reimplement, converting 284 implementation from tree to const svalue &. 285 (access_range::access_range): Add "mgr" param. Call strip_types 286 on region_offset initializations. 287 (access_range::get_size): Update decl for reimplementation. 288 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 289 selftest::analyzer_access_diagram_cc_tests. 290 * analyzer-selftests.h 291 (selftest::analyzer_checker_script_cc_tests): Delete this stray 292 typo. 293 (selftest::analyzer_access_diagram_cc_tests): New decl. 294 * analyzer.h (print_expr_for_user): New decl. 295 (calc_symbolic_bit_offset): Update decl for reimplementation. 296 (strip_types): New decls. 297 (remove_ssa_names): New decl. 298 * bounds-checking.cc (strip_types): New. 299 (region_model::check_symbolic_bounds): Use typeless svalues. 300 * region-model-manager.cc 301 (region_model_manager::get_or_create_constant_svalue): Add "type" 302 param. Add overload with old signature. 303 (region_model_manager::get_or_create_int_cst): Support type being 304 NULL_TREE. 305 (region_model_manager::maybe_fold_unaryop): Gracefully reject folding 306 of casts to NULL_TREE type. 307 (get_code_for_cast): Use NOP_EXPR for "casting" svalues to 308 NULL_TREE type. 309 (region_model_manager::get_or_create_cast): Support "casting" 310 svalues to NULL_TREE type. 311 (region_model_manager::maybe_fold_binop): Don't crash on inputs 312 with NULL_TREE type. Handle folding of binops on constants with 313 NULL_TREE type. Add missing cast from PR analyzer/110902. 314 Support enough folding of other ops on NULL_TREE type to support 315 bounds checking. 316 (region_model_manager::get_or_create_const_fn_result_svalue): 317 Remove assertion that type is nonnull. 318 * region-model-manager.h 319 (region_model_manager::get_or_create_constant_svalue): Add 320 overloaded decl taking a type. 321 (region_model_manager::maybe_fold_binop): Make public. 322 (region_model_manager::constants_map_t): Use 323 constant_svalue::key_t for the key, rather than just tree. 324 * region-model.cc (print_expr_for_user): New. 325 (selftest::test_array_2): Handle casts. 326 * region.cc (region_offset::calc_symbolic_bit_offset): Return 327 const svalue & rather than tree, and reimplement accordingly. 328 (region::calc_offset): Use ptrdiff_type_node for types of byte 329 offsets. 330 (region::maybe_print_for_user): New. 331 (element_region::get_relative_symbolic_offset): Use NULL_TREE for 332 types of bit offsets. 333 (offset_region::get_bit_offset): Likewise. 334 (sized_region::get_bit_size_sval): Likewise for bit sizes. 335 * region.h (region::maybe_print_for_user): New decl. 336 * svalue.cc (class auto_add_parens): New. 337 (svalue::maybe_print_for_user): New. 338 (svalue::cmp_ptr): Support typeless constant svalues. 339 (tristate_from_boolean_tree_node): New, taken from... 340 (constant_svalue::eval_condition): ...here. Handle comparison of 341 typeless integer svalue constants. 342 * svalue.h (svalue::maybe_print_for_user): New decl. 343 (class constant_svalue): Support the type of the svalue being 344 NULL_TREE. 345 (struct default_hash_traits<constant_svalue::key_t>): New. 346 347 2024-03-18 David Malcolm <dmalcolm (a] redhat.com> 348 349 * access-diagram.cc (remove_ssa_names): Support operands being 350 NULL_TREE, such as e.g. for COMPONENT_REF's operand 2. 351 352 2024-03-07 Jakub Jelinek <jakub (a] redhat.com> 353 354 * access-diagram.cc: Include diagnostic-core.h before including 355 diagnostic.h or diagnostic-path.h. 356 * sm-malloc.cc: Likewise. 357 * diagnostic-manager.cc: Likewise. 358 * call-summary.cc: Likewise. 359 * record-layout.cc: Likewise. 360 361 2024-02-29 David Malcolm <dmalcolm (a] redhat.com> 362 363 PR analyzer/114159 364 * analyzer.cc: Include "tree-dfa.h". 365 (get_ssa_default_def): New decl. 366 * analyzer.h (get_ssa_default_def): New. 367 * call-info.cc (call_info::call_info): New ctor taking an explicit 368 called_fn. 369 * call-info.h (call_info::call_info): Likewise. 370 * call-summary.cc (call_summary_replay::call_summary_replay): 371 Convert param from function * to const function &. 372 * call-summary.h (call_summary_replay::call_summary_replay): 373 Likewise. 374 * checker-event.h (state_change_event::get_dest_function): 375 Constify return value. 376 * engine.cc (point_and_state::validate): Update for conversion to 377 const function &. 378 (exploded_node::on_stmt): Likewise. 379 (call_summary_edge_info::call_summary_edge_info): Likewise. 380 Pass in called_fn to call_info ctor. 381 (exploded_node::replay_call_summaries): Update for conversion to 382 const function &. Convert per_function_data from * to &. 383 (exploded_node::replay_call_summary): Update for conversion to 384 const function &. 385 (exploded_graph::add_function_entry): Likewise. 386 (toplevel_function_p): Likewise. 387 (add_tainted_args_callback): Likewise. 388 (exploded_graph::build_initial_worklist): Likewise. 389 (exploded_graph::maybe_create_dynamic_call): Likewise. 390 (maybe_update_for_edge): Likewise. 391 (exploded_graph::on_escaped_function): Likewise. 392 * exploded-graph.h (exploded_node::replay_call_summaries): 393 Likewise. 394 (exploded_node::replay_call_summary): Likewise. 395 (exploded_graph::add_function_entry): Likewise. 396 * program-point.cc (function_point::from_function_entry): 397 Likewise. 398 (program_point::from_function_entry): Likewise. 399 * program-point.h (function_point::from_function_entry): Likewise. 400 (program_point::from_function_entry): Likewise. 401 * program-state.cc (program_state::push_frame): Likewise. 402 (program_state::get_current_function): Constify return type. 403 * program-state.h (program_state::push_frame): Update for 404 conversion to const function &. 405 (program_state::get_current_function): Likewise. 406 * region-model-manager.cc 407 (region_model_manager::get_frame_region): Likewise. 408 * region-model-manager.h 409 (region_model_manager::get_frame_region): Likewise. 410 * region-model.cc (region_model::called_from_main_p): Likewise. 411 (region_model::update_for_gcall): Likewise. 412 (region_model::push_frame): Likewise. 413 (region_model::get_current_function): Constify return type. 414 (region_model::pop_frame): Update for conversion to 415 const function &. 416 (selftest::test_stack_frames): Likewise. 417 (selftest::test_get_representative_path_var): Likewise. 418 (selftest::test_state_merging): Likewise. 419 (selftest::test_alloca): Likewise. 420 * region-model.h (region_model::push_frame): Likewise. 421 (region_model::get_current_function): Likewise. 422 * region.cc (frame_region::dump_to_pp): Likewise. 423 (frame_region::get_region_for_local): Likewise. 424 * region.h (class frame_region): Likewise. 425 * sm-signal.cc (signal_unsafe_call::describe_state_change): 426 Likewise. 427 (update_model_for_signal_handler): Likewise. 428 (signal_delivery_edge_info_t::update_model): Likewise. 429 (register_signal_handler::impl_transition): Likewise. 430 * state-purge.cc (class gimple_op_visitor): Likewise. 431 (state_purge_map::state_purge_map): Likewise. 432 (state_purge_map::get_or_create_data_for_decl): Likewise. 433 (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise. 434 (state_purge_per_ssa_name::add_to_worklist): Likewise. 435 (state_purge_per_ssa_name::process_point): Likewise. 436 (state_purge_per_decl::add_to_worklist): Likewise. 437 (state_purge_annotator::print_needed): Likewise. 438 * state-purge.h 439 (state_purge_map::get_or_create_data_for_decl): Likewise. 440 (class state_purge_per_tree): Likewise. 441 (class state_purge_per_ssa_name): Likewise. 442 (class state_purge_per_decl): Likewise. 443 * supergraph.cc (supergraph::dump_dot_to_pp): Likewise. 444 * supergraph.h 445 (supergraph::get_node_for_function_entry): Likewise. 446 (supergraph::get_node_for_function_exit): Likewise. 447 448 2024-02-27 David Malcolm <dmalcolm (a] redhat.com> 449 450 PR analyzer/110483 451 PR analyzer/111802 452 * access-diagram.cc 453 (string_literal_spatial_item::add_column_for_byte): Use %wu for 454 printing unsigned HOST_WIDE_INT. 455 456 2024-02-27 David Malcolm <dmalcolm (a] redhat.com> 457 458 PR analyzer/111881 459 * constraint-manager.cc (bound::ensure_closed): Assert that 460 m_constant has integral type. 461 (range::add_bound): Bail out on floating point constants. 462 463 2024-02-21 David Malcolm <dmalcolm (a] redhat.com> 464 465 PR analyzer/113999 466 * analyzer.h (get_string_cst_size): New decl. 467 * region-model-manager.cc (get_string_cst_size): New. 468 (region_model_manager::maybe_get_char_from_string_cst): Treat 469 single-byte accesses within string_cst but beyond 470 TREE_STRING_LENGTH as being 0. 471 * region-model.cc (string_cst_has_null_terminator): Likewise. 472 473 2024-02-21 David Malcolm <dmalcolm (a] redhat.com> 474 475 PR analyzer/113998 476 * ranges.cc (symbolic_byte_range::intersection): Handle empty ranges. 477 (selftest::test_intersects): Add test coverage for empty ranges. 478 479 2024-02-19 David Malcolm <dmalcolm (a] redhat.com> 480 481 PR analyzer/111289 482 * varargs.cc (representable_in_integral_type_p): New. 483 (va_arg_compatible_types_p): Add "arg_sval" param. Handle integer 484 types. 485 (kf_va_arg::impl_call_pre): Pass arg_sval to 486 va_arg_compatible_types_p. 487 488 2024-02-19 Andrew Pinski <quic_apinski (a] quicinc.com> 489 490 PR analyzer/113983 491 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Reject 492 non integral types. 493 494 2024-02-15 David Malcolm <dmalcolm (a] redhat.com> 495 496 PR analyzer/111266 497 * region.cc (offset_region::get_byte_size_sval): Delete. 498 (offset_region::get_bit_size_sval): Delete. 499 * region.h (region::get_byte_size): Add comment clarifying that 500 this relates to the size of the access, rather than the size 501 that's valid to access. 502 (region::get_bit_size): Likewise. 503 (region::get_byte_size_sval): Likewise. 504 (region::get_bit_size_sval): Likewise. 505 (offset_region::get_byte_size_sval): Delete. 506 (offset_region::get_bit_size_sval): Delete. 507 508 2024-02-13 David Malcolm <dmalcolm (a] redhat.com> 509 510 * pending-diagnostic.cc (diagnostic_emission_context::warn): 511 Update for renaming of emit_diagnostic_valist overload to 512 emit_diagnostic_valist_meta. 513 (diagnostic_emission_context::inform): Likewise. 514 515 2024-01-31 David Malcolm <dmalcolm (a] redhat.com> 516 517 PR analyzer/113253 518 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable 519 for debug statements. 520 * state-purge.cc 521 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any 522 debug stmts in the FOR_EACH_IMM_USE_FAST list. 523 * supergraph.cc (supergraph::supergraph): Don't add debug stmts 524 to the supernodes. 525 526 2024-01-31 David Malcolm <dmalcolm (a] redhat.com> 527 528 PR analyzer/113509 529 * checker-event.cc (state_change_event::get_desc): Don't assume 530 "var" is non-NULL. 531 532 2024-01-30 David Malcolm <dmalcolm (a] redhat.com> 533 534 PR analyzer/113654 535 * region-model.cc (is_round_up): New. 536 (is_multiple_p): New. 537 (is_dubious_capacity): New. 538 (region_model::check_region_size): Move usage of size_visitor into 539 is_dubious_capacity. 540 541 2024-01-30 David Malcolm <dmalcolm (a] redhat.com> 542 543 * region-model.cc 544 (dubious_allocation_size::dubious_allocation_size): Add 545 "capacity_sval" param. Drop unused ctor. 546 (dubious_allocation_size::maybe_add_sarif_properties): New. 547 (dubious_allocation_size::m_capacity_sval): New field. 548 (region_model::check_region_size): Pass capacity svalue to 549 dubious_allocation_size ctor. 550 551 2024-01-25 David Malcolm <dmalcolm (a] redhat.com> 552 553 PR analyzer/112969 554 * store.cc (binding_cluster::maybe_get_compound_binding): When 555 populating default_map, express the bit-range of the default key 556 for REG relative to REG, rather than to the base region. 557 558 2024-01-24 David Malcolm <dmalcolm (a] redhat.com> 559 560 PR analyzer/112977 561 * engine.cc (impl_region_model_context::on_liveness_change): Pass 562 m_ext_state to sm_state_map::on_liveness_change. 563 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal 564 of map entry based on can_purge_p. 565 (sm_state_map::on_liveness_change): Add ext_state param. Add 566 workaround for bad interaction between state purging and 567 alt-inherited sm-state. 568 * program-state.h (sm_state_map::on_liveness_change): Add 569 ext_state param. 570 * sm-taint.cc 571 (taint_state_machine::has_alt_get_inherited_state_p): New. 572 (taint_state_machine::can_purge_p): Return false for "has_lb" and 573 "has_ub". 574 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc. 575 576 2024-01-18 David Malcolm <dmalcolm (a] redhat.com> 577 578 PR analyzer/111361 579 * region-model.cc (svalue_byte_range_has_null_terminator_1): The 580 initial byte of an all-zeroes SVAL is a zero byte. Remove 581 gcc_unreachable from SK_CONSTANT for constants that aren't 582 STRING_CST or INTEGER_CST. 583 584 2024-01-18 David Malcolm <dmalcolm (a] redhat.com> 585 586 PR analyzer/112811 587 * region-model.cc (fragment::dump_to_pp): New. 588 (fragment::has_null_terminator): Convert to... 589 (svalue_byte_range_has_null_terminator_1): ...this new function, 590 updating to use a byte_range relative to the start of the svalue. 591 (svalue_byte_range_has_null_terminator): New. 592 (fragment::string_cst_has_null_terminator): Convert to... 593 (string_cst_has_null_terminator): ...this, updating to use a 594 byte_range relative to the start of the svalue. 595 (iterable_cluster::dump_to_pp): New. 596 (region_model::scan_for_null_terminator): Add logging, moving body 597 to... 598 (region_model::scan_for_null_terminator_1): ...this new function, 599 adding more logging, and updating to use 600 svalue_byte_range_has_null_terminator. 601 * region-model.h (region_model::scan_for_null_terminator_1): New 602 decl. 603 604 2024-01-16 David Malcolm <dmalcolm (a] redhat.com> 605 606 PR analyzer/106229 607 * analyzer.h (compare_constants): New decl. 608 * constraint-manager.cc (compare_constants): Make non-static. 609 * sm-taint.cc: Add include "fold-const.h". 610 (class concrete_range): New. 611 (get_possible_range): New. 612 (index_can_be_out_of_bounds_p): New. 613 (region_model::check_region_for_taint): Reject 614 -Wanalyzer-tainted-array-index if the type of the value makes it 615 impossible for it to be out-of-bounds of the array. 616 617 2024-01-16 David Malcolm <dmalcolm (a] redhat.com> 618 619 PR analyzer/113333 620 * region-model-manager.cc 621 (region_model_manager::maybe_fold_unaryop): Casting all zeroes 622 should give all zeroes. 623 624 2024-01-04 David Malcolm <dmalcolm (a] redhat.com> 625 626 * analyzer.opt.urls: New file, autogenerated by 627 regenerate-opt-urls.py. 628 629 2024-01-04 David Malcolm <dmalcolm (a] redhat.com> 630 631 * checker-event.cc: Include "diagnostic-format-sarif.h" and 632 "tree-logical-location.h". 633 (checker_event::maybe_add_sarif_properties): New. 634 (superedge_event::maybe_add_sarif_properties): New. 635 (superedge_event::superedge_event): Add comment. 636 * checker-event.h (checker_event::maybe_add_sarif_properties): New 637 decl. 638 (superedge_event::maybe_add_sarif_properties): New decl. 639 640 2024-01-04 David Malcolm <dmalcolm (a] redhat.com> 641 642 PR analyzer/112790 643 * checker-event.cc (class inlining_info): Move to... 644 * inlining-iterator.h (class inlining_info): ...here. 645 * sm-malloc.cc: Include "analyzer/inlining-iterator.h". 646 (maybe_complain_about_deref_before_check): Reject stmts that were 647 inlined from another function. 648 649 2024-01-04 David Malcolm <dmalcolm (a] redhat.com> 650 651 PR analyzer/113222 652 * access-diagram.cc (valid_region_spatial_item::add_boundaries): 653 Handle TYPE_DOMAIN being null. 654 (valid_region_spatial_item::add_array_elements_to_table): 655 Likewise. 656 657 2023-12-16 David Malcolm <dmalcolm (a] redhat.com> 658 659 * analyzer.cc: Include "tree-pretty-print.h" and 660 "diagnostic-event-id.h". 661 (tree_to_json): New. 662 (diagnostic_event_id_to_json): New. 663 (bit_offset_to_json): New. 664 (byte_offset_to_json): New. 665 * analyzer.h (tree_to_json): New decl. 666 (diagnostic_event_id_to_json): New decl. 667 (bit_offset_to_json): New decl. 668 (byte_offset_to_json): New decl. 669 * bounds-checking.cc: Include "diagnostic-format-sarif.h". 670 (out_of_bounds::maybe_add_sarif_properties): New. 671 (concrete_out_of_bounds::maybe_add_sarif_properties): New. 672 (concrete_past_the_end::maybe_add_sarif_properties): New. 673 (symbolic_past_the_end::maybe_add_sarif_properties): New. 674 * region-model.cc (region_to_value_map::to_json): New. 675 (region_model::to_json): New. 676 * region-model.h (region_to_value_map::to_json): New decl. 677 (region_model::to_json): New decl. 678 * store.cc (bit_range::to_json): New. 679 (byte_range::to_json): New. 680 * store.h (bit_range::to_json): New decl. 681 (byte_range::to_json): New decl. 682 683 2023-12-16 David Malcolm <dmalcolm (a] redhat.com> 684 685 PR analyzer/112792 686 * bounds-checking.cc 687 (out_of_bounds::oob_region_creation_event_capacity): Rename 688 "capacity" to "byte_capacity". Layout fix. 689 (out_of_bounds::::add_region_creation_events): Rename 690 "capacity" to "byte_capacity". 691 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to 692 m_out_of_bounds_bits and convert from a byte_range to a bit_range. 693 (concrete_out_of_bounds::get_out_of_bounds_bytes): New. 694 (concrete_past_the_end::concrete_past_the_end): Rename param 695 "byte_bound" to "bit_bound". Initialize m_byte_bound. 696 (concrete_past_the_end::subclass_equal_p): Update for renaming 697 of m_byte_bound to m_bit_bound. 698 (concrete_past_the_end::m_bit_bound): New field. 699 (concrete_buffer_overflow::concrete_buffer_overflow): Convert 700 param "range" from byte_range to bit_range. Rename param 701 "byte_bound" to "bit_bound". 702 (concrete_buffer_overflow::emit): Update for bits vs bytes. 703 (concrete_buffer_overflow::describe_final_event): Split 704 into... 705 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this 706 (concrete_buffer_overflow::describe_final_event_as_bits): ...and 707 this. 708 (concrete_buffer_over_read::concrete_buffer_over_read): Convert 709 param "range" from byte_range to bit_range. Rename param 710 "byte_bound" to "bit_bound". 711 (concrete_buffer_over_read::emit): Update for bits vs bytes. 712 (concrete_buffer_over_read::describe_final_event): Split into... 713 (concrete_buffer_over_read::describe_final_event_as_bytes): 714 ...this 715 (concrete_buffer_over_read::describe_final_event_as_bits): ...and 716 this. 717 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert 718 param "range" from byte_range to bit_range. 719 (concrete_buffer_underwrite::describe_final_event): Split into... 720 (concrete_buffer_underwrite::describe_final_event_as_bytes): 721 ...this 722 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and 723 this. 724 (concrete_buffer_under_read::concrete_buffer_under_read): Convert 725 param "range" from byte_range to bit_range. 726 (concrete_buffer_under_read::describe_final_event): Split into... 727 (concrete_buffer_under_read::describe_final_event_as_bytes): 728 ...this 729 (concrete_buffer_under_read::describe_final_event_as_bits): ...and 730 this. 731 (region_model::check_region_bounds): Use bits for concrete values, 732 and rename locals to indicate whether we're dealing with bits or 733 bytes. Specifically, replace "num_bytes_sval" with 734 "num_bits_sval", and get it from reg's "get_bit_size_sval". 735 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity" 736 to "byte_capacity". Rename "cst_capacity_tree" to 737 "cst_byte_capacity_tree". Replace "offset" and 738 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned" 739 respectively, converting from byte_offset_t to bit_offset_t. 740 Replace "out" and "read_bytes" with "bits_outside" and "read_bits" 741 respectively, converting from byte_range to bit_range. Convert 742 "buffer" from byte_range to bit_range. Replace "byte_bound" with 743 "bit_bound". 744 * region.cc (region::get_bit_size_sval): New. 745 (offset_region::get_bit_offset): New. 746 (offset_region::get_bit_size_sval): New. 747 (sized_region::get_bit_size_sval): New. 748 (bit_range_region::get_bit_size_sval): New. 749 * region.h (region::get_bit_size_sval): New vfunc. 750 (offset_region::get_bit_offset): New decl. 751 (offset_region::get_bit_size_sval): New decl. 752 (sized_region::get_bit_size_sval): New decl. 753 (bit_range_region::get_bit_size_sval): New decl. 754 * store.cc (bit_range::intersects_p): New, based on 755 byte_range::intersects_p. 756 (bit_range::exceeds_p): New, based on byte_range::exceeds_p. 757 (bit_range::falls_short_of_p): New, based on 758 byte_range::falls_short_of_p. 759 (byte_range::intersects_p): Delete. 760 (byte_range::exceeds_p): Delete. 761 (byte_range::falls_short_of_p): Delete. 762 * store.h (bit_range::intersects_p): New overload. 763 (bit_range::exceeds_p): New. 764 (bit_range::falls_short_of_p): New. 765 (byte_range::intersects_p): Delete. 766 (byte_range::exceeds_p): Delete. 767 (byte_range::falls_short_of_p): Delete. 768 769 2023-12-14 David Malcolm <dmalcolm (a] redhat.com> 770 771 PR analyzer/112655 772 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges 773 via rvalue reference rather than by value. 774 (starts_infinite_loop_p): Move eedges when constructing an 775 infinite_loop instance. 776 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use 777 initializer list for states. 778 * sm-sensitive.cc 779 (sensitive_state_machine::sensitive_state_machine): Likewise. 780 * sm-signal.cc (signal_state_machine::signal_state_machine): 781 Likewise. 782 * sm-taint.cc (taint_state_machine::taint_state_machine): 783 Likewise. 784 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise. 785 786 2023-12-11 David Malcolm <dmalcolm (a] redhat.com> 787 788 PR analyzer/112955 789 * engine.cc (feasibility_state::feasibility_state): Initialize 790 m_snodes_visited. 791 792 2023-12-11 Andrew Pinski <apinski (a] marvell.com> 793 794 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove 795 the check for type being unsigned_char_type_node. 796 797 2023-12-08 David Malcolm <dmalcolm (a] redhat.com> 798 799 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix 800 handling of TRUNC_MOD_EXPR. 801 802 2023-12-08 David Malcolm <dmalcolm (a] redhat.com> 803 804 * region-model.cc (contains_uninit_p): Only check for 805 svalues that the infoleak warning can handle. 806 807 2023-12-08 David Malcolm <dmalcolm (a] redhat.com> 808 809 PR analyzer/112889 810 * store.h (concrete_binding::concrete_binding): Strengthen 811 assertion to require size to be be positive, rather than just 812 non-zero. 813 (concrete_binding::mark_deleted): Use size rather than start bit 814 offset. 815 (concrete_binding::mark_empty): Likewise. 816 (concrete_binding::is_deleted): Likewise. 817 (concrete_binding::is_empty): Likewise. 818 819 2023-12-07 Alexandre Oliva <oliva (a] adacore.com> 820 821 * region-model.cc (has_nondefault_case_for_value_p): Take 822 enumerate type as a parameter. 823 (region_model::apply_constraints_for_gswitch): Cope with 824 integral promotion type casts. 825 826 2023-12-07 David Malcolm <dmalcolm (a] redhat.com> 827 828 PR analyzer/103546 829 PR analyzer/112850 830 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from 831 12 to 18. 832 (Wanalyzer-symbol-too-complex): New. 833 * diagnostic-manager.cc 834 (null_assignment_sm_context::clear_all_per_svalue_state): New. 835 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New. 836 * program-state.cc (sm_state_map::clear_all_per_svalue_state): 837 New. 838 * program-state.h (sm_state_map::clear_all_per_svalue_state): New 839 decl. 840 * region-model-manager.cc 841 (region_model_manager::reject_if_too_complex): Add 842 -Wanalyzer-symbol-too-complex. 843 * sm-taint.cc (taint_state_machine::on_condition): Handle 844 comparisons against UNKNOWN. 845 * sm.h (sm_context::clear_all_per_svalue_state): New. 846 847 2023-12-06 David Malcolm <dmalcolm (a] redhat.com> 848 849 * engine.cc (dump_analyzer_json): Use 850 flag_diagnostics_json_formatting. 851 852 2023-12-01 David Malcolm <dmalcolm (a] redhat.com> 853 854 * analyzer.h (class saved_diagnostic): New forward decl. 855 * bounds-checking.cc: Update for changes to 856 pending_diagnostic::emit. 857 * call-details.cc: Likewise. 858 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h". 859 (saved_diagnostic::maybe_add_sarif_properties): New. 860 (class pending_diagnostic_metadata): New. 861 (diagnostic_manager::emit_saved_diagnostic): Create a 862 pending_diagnostic_metadata and a diagnostic_emission_context. 863 Pass the latter to the pending_diagnostic::emit vfunc. 864 * diagnostic-manager.h 865 (saved_diagnostic::maybe_add_sarif_properties): New decl. 866 * engine.cc: Update for changes to pending_diagnostic::emit. 867 * infinite-loop.cc: Likewise. 868 * infinite-recursion.cc: Likewise. 869 * kf-analyzer.cc: Likewise. 870 * kf.cc: Likewise. 871 * pending-diagnostic.cc 872 (diagnostic_emission_context::get_pending_diagnostic): New. 873 (diagnostic_emission_context::warn): New. 874 (diagnostic_emission_context::inform): New. 875 * pending-diagnostic.h (class diagnostic_emission_context): New. 876 (pending_diagnostic::emit): Update params. 877 (pending_diagnostic::maybe_add_sarif_properties): New vfunc. 878 * region.cc: Don't include "diagnostic-metadata.h". 879 * region-model.cc: Include "diagnostic-format-sarif.h". Update 880 for changes to pending_diagnostic::emit. 881 (exposure_through_uninit_copy::maybe_add_sarif_properties): New. 882 * sm-fd.cc: Update for changes to pending_diagnostic::emit. 883 * sm-file.cc: Likewise. 884 * sm-malloc.cc: Likewise. 885 * sm-pattern-test.cc: Likewise. 886 * sm-sensitive.cc: Likewise. 887 * sm-signal.cc: Likewise. 888 * sm-taint.cc: Likewise. 889 * store.cc: Don't include "diagnostic-metadata.h". 890 * varargs.cc: Update for changes to pending_diagnostic::emit. 891 892 2023-11-19 David Malcolm <dmalcolm (a] redhat.com> 893 894 * analyzer.h: Include "rich-location.h". 895 896 2023-11-19 David Malcolm <dmalcolm (a] redhat.com> 897 898 PR analyzer/107573 899 * analyzer.h (register_known_functions): Add region_model_manager 900 param. 901 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New. 902 * call-summary.cc 903 (call_summary_replay::convert_region_from_summary_1): Handle 904 RK_PRIVATE. 905 * engine.cc (impl_run_checkers): Pass model manager to 906 register_known_functions. 907 * kf.cc (class undefined_function_behavior): New. 908 (class kf_strtok): New. 909 (register_known_functions): Add region_model_manager param. 910 Use it to register "strtok". 911 * region-model-manager.cc 912 (region_model_manager::get_or_create_conjured_svalue): Add "idx" 913 param. 914 * region-model-manager.h 915 (region_model_manager::get_or_create_conjured_svalue): Add "idx" 916 param. 917 (region_model_manager::get_root_region): New accessor. 918 * region-model.cc (region_model::scan_for_null_terminator): Handle 919 "expr" being null. 920 (region_model::get_representative_path_var_1): Handle RK_PRIVATE. 921 * region-model.h (region_model::called_from_main_p): Make public. 922 * region.cc (region::get_memory_space): Handle RK_PRIVATE. 923 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE. 924 (private_region::dump_to_pp): New. 925 * region.h (MEMSPACE_PRIVATE): New. 926 (RK_PRIVATE): New. 927 (class private_region): New. 928 (is_a_helper <const private_region *>::test): New. 929 * store.cc (store::replay_call_summary_cluster): Handle 930 RK_PRIVATE. 931 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to 932 ctor and "m_idx" field. 933 (class conjured_svalue::conjured_svalue): Likewise. 934 935 2023-11-18 David Malcolm <dmalcolm (a] redhat.com> 936 937 PR analyzer/106147 938 * analyzer.opt (Wanalyzer-infinite-loop): New option. 939 (fdump-analyzer-infinite-loop): New option. 940 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final". 941 (start_cfg_edge_event::maybe_describe_condition): Convert from 942 private to protected. 943 * checker-path.h (checker_path::get_logger): New. 944 * diagnostic-manager.cc (process_worklist_item): Update for 945 new context param of maybe_update_for_edge. 946 * engine.cc 947 (impl_region_model_context::impl_region_model_context): Add 948 out_could_have_done_work param to both ctors and use it to 949 initialize mm_out_could_have_done_work. 950 (impl_region_model_context::maybe_did_work): New vfunc 951 implementation. 952 (exploded_node::on_stmt): Add out_could_have_done_work param and 953 pass to ctxt ctor. 954 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing 955 work". 956 (exploded_node::on_longjmp): Likewise. 957 (exploded_edge::exploded_edge): Add "could_do_work" param and use 958 it to initialize m_could_do_work_p. 959 (exploded_edge::dump_dot_label): Add result of could_do_work_p. 960 (exploded_graph::add_function_entry): Mark edge as doing no work. 961 (exploded_graph::add_edge): Add "could_do_work" param and pass to 962 exploded_edge ctor. 963 (add_tainted_args_callback): Treat as doing no work. 964 (exploded_graph::process_worklist): Likewise when merging nodes. 965 (maybe_process_run_of_before_supernode_enodes::item): Likewise. 966 (exploded_graph::maybe_create_dynamic_call): Likewise. 967 (exploded_graph::process_node): Likewise for phi nodes. 968 Pass in a "could_have_done_work" bool when handling stmts and use 969 when creating edges. Assume work is done at bifurcation. 970 (exploded_path::feasible_p): Update for new context param of 971 maybe_update_for_edge. 972 (feasibility_state::feasibility_state): New ctor. 973 (feasibility_state::operator=): New. 974 (feasibility_state::maybe_update_for_edge): Add ctxt param and use 975 it. Fix missing newline when logging state. 976 (impl_run_checkers): Call exploded_graph::detect_infinite_loops. 977 * exploded-graph.h 978 (impl_region_model_context::impl_region_model_context): Add 979 out_could_have_done_work param to both ctors. 980 (impl_region_model_context::maybe_did_work): New decl. 981 (impl_region_model_context::checking_for_infinite_loop_p): New. 982 (impl_region_model_context::on_unusable_in_infinite_loop): New. 983 (impl_region_model_context::m_out_could_have_done_work): New 984 field. 985 (exploded_node::on_stmt): Add "out_could_have_done_work" param. 986 (exploded_edge::exploded_edge): Add "could_do_work" param. 987 (exploded_edge::could_do_work_p): New accessor. 988 (exploded_edge::m_could_do_work_p): New field. 989 (exploded_graph::add_edge): Add "could_do_work" param. 990 (exploded_graph::detect_infinite_loops): New decl. 991 (feasibility_state::feasibility_state): New ctor. 992 (feasibility_state::operator=): New decl. 993 (feasibility_state::maybe_update_for_edge): Add ctxt param. 994 * infinite-loop.cc: New file. 995 * program-state.cc (program_state::on_edge): Log the rejected 996 constraint when region_model::maybe_update_for_edge fails. 997 * region-model.cc (region_model::on_assignment): Treat any writes 998 other than to the stack as "doing work". 999 (region_model::on_stmt_pre): Treat all asm stmts as "doing work". 1000 (region_model::on_call_post): Likewise for all calls to functions 1001 with unknown side effects. 1002 (region_model::handle_phi): Add svals_changing_meaning param. 1003 Mark widening svalue in phi nodes as changing meaning. 1004 (unusable_in_infinite_loop_constraint_p): New. 1005 (region_model::add_constraint): If we're checking for an infinite 1006 loop, bail out on unusable svalues, or if we don't have a definite 1007 true/false for the constraint. 1008 (region_model::update_for_phis): Gather all svalues changing 1009 meaning in phi nodes, and purge constraints involving them. 1010 (region_model::replay_call_summary): Treat all call summaries as 1011 doing work. 1012 (region_model::can_merge_with_p): Purge constraints involving 1013 svalues that change meaning. 1014 (model_merger::on_widening_reuse): New. 1015 (test_iteration_1): Likewise. 1016 (selftest::test_iteration_1): Remove assertion that model6 "knows" 1017 that i < 157. 1018 * region-model.h (region_model::handle_phi): Add 1019 svals_changing_meaning param 1020 (region_model_context::maybe_did_work): New pure virtual func. 1021 (region_model_context::checking_for_infinite_loop_p): Likewise. 1022 (region_model_context::on_unusable_in_infinite_loop): Likewise. 1023 (noop_region_model_context::maybe_did_work): Implement. 1024 (noop_region_model_context::checking_for_infinite_loop_p): 1025 Likewise. 1026 (noop_region_model_context::on_unusable_in_infinite_loop): 1027 Likewise. 1028 (region_model_context_decorator::maybe_did_work): Implement. 1029 (region_model_context_decorator::checking_for_infinite_loop_p): 1030 Likewise. 1031 (region_model_context_decorator::on_unusable_in_infinite_loop): 1032 Likewise. 1033 (model_merger::on_widening_reuse): New decl. 1034 (model_merger::m_svals_changing_meaning): New field. 1035 * sm-signal.cc (register_signal_handler::impl_transition): Assume 1036 the edge "does work". 1037 * supergraph.cc (supernode::get_start_location): Use CFG edge's 1038 goto_locus if available. 1039 (supernode::get_end_location): Likewise. 1040 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus" 1041 * supergraph.h (cfg_superedge::get_goto_locus): New. 1042 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for 1043 widening values. 1044 (involvement_visitor::visit_widening_svalue): New. 1045 (svalue::involves_p): Update assertion to allow widening svalues. 1046 1047 2023-11-14 David Malcolm <dmalcolm (a] redhat.com> 1048 1049 PR analyzer/103533 1050 * sm-taint.cc: Remove "experimental" from comment. 1051 * sm.cc (make_checkers): Always add taint state machine. 1052 1053 2023-11-04 David Malcolm <dmalcolm (a] redhat.com> 1054 1055 * bounds-checking.cc: Update for changes to diagnostic_context. 1056 1057 2023-11-02 David Malcolm <dmalcolm (a] redhat.com> 1058 1059 PR analyzer/112317 1060 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate 1061 unused field "m_col_widths". 1062 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for 1063 above change. 1064 * region-model.cc 1065 (check_one_function_attr_null_terminated_string_arg): Remove 1066 unused variables "cd_unchecked", "strlen_sval", and 1067 "limited_sval". 1068 * region-model.h (region_model_context_decorator::warn): Add 1069 missing "override". 1070 1071 2023-10-31 David Malcolm <dmalcolm (a] redhat.com> 1072 1073 * record-layout.cc: New file, based on material in region-model.cc. 1074 * record-layout.h: Likewise. 1075 * region-model.cc: Include "analyzer/record-layout.h". 1076 (class record_layout): Move to record-layout.cc and .h 1077 1078 2023-10-26 David Malcolm <dmalcolm (a] redhat.com> 1079 1080 * region-model.cc 1081 (region_model::check_external_function_for_access_attr): Split 1082 out, replacing with... 1083 (region_model::check_function_attr_access): ...this new function 1084 and... 1085 (region_model::check_function_attrs): ...this new function. 1086 (region_model::check_one_function_attr_null_terminated_string_arg): 1087 New. 1088 (region_model::check_function_attr_null_terminated_string_arg): 1089 New. 1090 (region_model::handle_unrecognized_call): Update for renaming of 1091 check_external_function_for_access_attr to check_function_attrs. 1092 (region_model::check_for_null_terminated_string_arg): Add return 1093 value to one overload. Make both overloads const. 1094 * region-model.h: Include "stringpool.h" and "attribs.h". 1095 (region_model::check_for_null_terminated_string_arg): Add return 1096 value to one overload. Make both overloads const. 1097 (region_model::check_external_function_for_access_attr): Delete 1098 decl. 1099 (region_model::check_function_attr_access): New decl. 1100 (region_model::check_function_attr_null_terminated_string_arg): 1101 New decl. 1102 (region_model::check_one_function_attr_null_terminated_string_arg): 1103 New decl. 1104 (region_model::check_function_attrs): New decl. 1105 1106 2023-10-09 David Malcolm <dmalcolm (a] redhat.com> 1107 1108 * access-diagram.cc (boundaries::add): Explicitly state 1109 "boundaries::" scope for "kind" enum. 1110 1111 2023-10-08 David Malcolm <dmalcolm (a] redhat.com> 1112 1113 PR analyzer/111155 1114 * access-diagram.cc (boundaries::boundaries): Add logger param 1115 (boundaries::add): Add logging. 1116 (boundaries::get_hard_boundaries_in_range): New. 1117 (boundaries::m_logger): New field. 1118 (boundaries::get_table_x_for_offset): Make public. 1119 (class svalue_spatial_item): New. 1120 (class compound_svalue_spatial_item): New. 1121 (add_ellipsis_to_gaps): New. 1122 (valid_region_spatial_item::valid_region_spatial_item): Add theme 1123 param. Initialize m_boundaries, m_existing_sval, and 1124 m_existing_sval_spatial_item. 1125 (valid_region_spatial_item::add_boundaries): Set m_boundaries. 1126 Add boundaries for any m_existing_sval_spatial_item. 1127 (valid_region_spatial_item::add_array_elements_to_table): Rewrite 1128 creation of min/max index in terms of 1129 maybe_add_array_index_to_table. Rewrite ellipsis code using 1130 add_ellipsis_to_gaps. Add index values for any hard boundaries 1131 within the valid region. 1132 (valid_region_spatial_item::maybe_add_array_index_to_table): New, 1133 based on code formerly in add_array_elements_to_table. 1134 (valid_region_spatial_item::make_table): Make use of 1135 m_existing_sval_spatial_item, if any. 1136 (valid_region_spatial_item::m_boundaries): New field. 1137 (valid_region_spatial_item::m_existing_sval): New field. 1138 (valid_region_spatial_item::m_existing_sval_spatial_item): New 1139 field. 1140 (class svalue_spatial_item): Rename to... 1141 (class written_svalue_spatial_item): ...this. 1142 (class string_region_spatial_item): Rename to.. 1143 (class string_literal_spatial_item): ...this. Add "kind". 1144 (string_literal_spatial_item::add_boundaries): Use m_kind to 1145 determine kind of boundary. Update for renaming of m_actual_bits 1146 to m_bits. 1147 (string_literal_spatial_item::make_table): Likewise. Support not 1148 displaying a row for byte indexes, and not displaying a row for 1149 the type. 1150 (string_literal_spatial_item::add_column_for_byte): Make byte index 1151 row optional. 1152 (svalue_spatial_item::make): Convert to... 1153 (make_written_svalue_spatial_item): ...this. 1154 (make_existing_svalue_spatial_item): New. 1155 (access_diagram_impl::access_diagram_impl): Pass theme to 1156 m_valid_region_spatial_item ctor. Update for renaming of 1157 m_svalue_spatial_item. 1158 (access_diagram_impl::find_boundaries): Pass logger to boundaries. 1159 Update for renaming of... 1160 (access_diagram_impl::m_svalue_spatial_item): Rename to... 1161 (access_diagram_impl::m_written_svalue_spatial_item): ...this. 1162 1163 2023-10-03 David Malcolm <dmalcolm (a] redhat.com> 1164 1165 * analyzer-logging.cc (logger::log_va_partial): Use text_info 1166 ctor. 1167 * analyzer.cc (make_label_text): Likewise. 1168 (make_label_text_n): Likewise. 1169 * pending-diagnostic.cc (evdesc::event_desc::formatted_print): 1170 Likewise. 1171 1172 2023-10-02 David Malcolm <dmalcolm (a] redhat.com> 1173 1174 * program-point.cc: Update for grouping of source printing fields 1175 within diagnostic_context. 1176 1177 2023-09-15 David Malcolm <dmalcolm (a] redhat.com> 1178 1179 * analyzer.cc (get_stmt_location): Handle null stmt. 1180 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy 1181 m_loc from ploc. 1182 (saved_diagnostic::operator==): Compare m_loc. 1183 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if 1184 m_loc is unknown. 1185 (dedupe_key::dedupe_key): Initialize m_loc. 1186 (dedupe_key::operator==): Compare m_loc. 1187 (dedupe_key::get_location): Use m_loc if it's known. 1188 (dedupe_key::m_loc): New field. 1189 (diagnostic_manager::emit_saved_diagnostic): Only call 1190 get_emission_location if m_loc is unknown, preferring to use m_loc 1191 if it's available. 1192 * diagnostic-manager.h (saved_diagnostic::m_loc): New field. 1193 (pending_location::pending_location): Initialize m_loc. Add 1194 overload taking a location_t rather than a stmt/stmt_finder. 1195 (pending_location::m_loc): New field. 1196 1197 2023-09-15 David Malcolm <dmalcolm (a] redhat.com> 1198 1199 * analyzer.h (struct pending_location): New forward decl. 1200 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): 1201 Replace params "enode", "snode", "stmt", and "stmt_finder" with 1202 "ploc". 1203 (diagnostic_manager::add_diagnostic): Likewise for both overloads. 1204 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): 1205 Likewise. 1206 (struct pending_location): New. 1207 (diagnostic_manager::add_diagnostic): Replace params "enode", 1208 "snode", "stmt", and "stmt_finder" with "ploc". 1209 * engine.cc (impl_region_model_context::warn): Update call to 1210 add_diagnostic for above change. 1211 (impl_sm_context::warn): Likewise. 1212 (impl_region_model_context::on_state_leak): Likewise. 1213 * infinite-recursion.cc 1214 (exploded_graph::detect_infinite_recursion): Likewise. 1215 1216 2023-09-15 David Malcolm <dmalcolm (a] redhat.com> 1217 1218 * region-model.cc (region_model::get_gassign_result): Handle 1219 volatile ops by using a conjured_svalue. 1220 1221 2023-09-14 David Malcolm <dmalcolm (a] redhat.com> 1222 1223 * checker-event.h (checker_event::get_thread_id): New. 1224 * checker-path.h (class checker_path): Implement thread-related 1225 vfuncs via a single simple_diagnostic_thread instance named 1226 "main". 1227 1228 2023-09-14 David Malcolm <dmalcolm (a] redhat.com> 1229 1230 * diagnostic-manager.cc (compatible_epath_p): Fix missing return. 1231 1232 2023-09-14 David Malcolm <dmalcolm (a] redhat.com> 1233 1234 * diagnostic-manager.cc (process_worklist_item): Use 1235 std::unique_ptr rather than plain rejected_constraint *. 1236 * engine.cc (exploded_path::feasible_p): Likewise. 1237 (feasibility_state::maybe_update_for_edge): Likewise. 1238 * exploded-graph.h (feasibility_problem::feasibility_problem): 1239 Likewise. 1240 (feasibility_problem::~feasibility_problem): Delete. 1241 (feasibility_problem::m_rc): Use std::unique_ptr. 1242 (feasibility_state::maybe_update_for_edge): Likewise. 1243 * feasible-graph.cc (feasible_graph::add_feasibility_problem): 1244 Likewise. 1245 * feasible-graph.h (class infeasible_node): Likewise. 1246 (feasible_graph::add_feasibility_problem): Likewise. 1247 * region-model.cc (region_model::add_constraint): Likewise. 1248 (region_model::maybe_update_for_edge): Likewise. 1249 (region_model::apply_constraints_for_gcond): Likewise. 1250 (region_model::apply_constraints_for_gswitch): Likewise. 1251 (region_model::apply_constraints_for_exception): Likewise. 1252 * region-model.h (class region_model): Likewise for decls. 1253 1254 2023-09-09 benjamin priour <vultkayn (a] gcc.gnu.org> 1255 1256 PR analyzer/96395 1257 * region-model.cc 1258 (region_model::add_constraints_from_binop): binop_svalues around 1259 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped. 1260 1261 2023-09-07 David Malcolm <dmalcolm (a] redhat.com> 1262 1263 PR analyzer/110529 1264 * program-point.cc (program_point::on_edge): Don't reject 1265 EDGE_ABNORMAL for computed gotos. 1266 * region-model.cc (region_model::maybe_update_for_edge): Handle 1267 computed goto statements. 1268 (region_model::apply_constraints_for_ggoto): New. 1269 * region-model.h (region_model::apply_constraints_for_ggoto): New decl. 1270 * supergraph.cc (supernode::get_label): New. 1271 * supergraph.h (supernode::get_label): New decl. 1272 1273 2023-09-07 benjamin priour <vultkayn (a] gcc.gnu.org> 1274 David Malcolm <dmalcolm (a] redhat.com> 1275 1276 PR analyzer/110830 1277 * diagnostic-manager.cc 1278 (compatible_epaths_p): New function. 1279 (saved_diagnostic::supercedes_p): Now calls the above 1280 to determine if the diagnostics do overlap and the superseding 1281 may proceed. 1282 1283 2023-09-07 David Malcolm <dmalcolm (a] redhat.com> 1284 1285 * region-model.h: fix -Wunused-parameter warnings 1286 1287 2023-09-06 David Malcolm <dmalcolm (a] redhat.com> 1288 1289 PR analyzer/105899 1290 * kf.cc (class kf_strstr): New. 1291 (kf_strstr::impl_call_post): New. 1292 (register_known_functions): Register it. 1293 1294 2023-09-06 David Malcolm <dmalcolm (a] redhat.com> 1295 1296 PR analyzer/105899 1297 * kf.cc (class kf_strncpy): New. 1298 (kf_strncpy::impl_call_post): New. 1299 (register_known_functions): Register it. 1300 * region-model.cc (region_model::read_bytes): Handle unknown 1301 number of bytes. 1302 1303 2023-09-06 David Malcolm <dmalcolm (a] redhat.com> 1304 1305 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region. 1306 (kf_memset::impl_call_pre): Move responsibility for calling 1307 check_region_for_write to fill_region. 1308 * region-model.cc (region_model::on_assignment): Pass ctxt to 1309 zero_fill_region. 1310 (region_model::fill_region): Add "ctxt" param, using it to call 1311 check_region_for_write. 1312 (region_model::zero_fill_region): Likewise. 1313 * region-model.h (region_model::fill_region): Add "ctxt" param. 1314 (region_model::zero_fill_region): Likewise. 1315 1316 2023-09-01 benjamin priour <priour.be (a] gmail.com> 1317 1318 PR analyzer/105948 1319 PR analyzer/94355 1320 * analyzer.h (is_placement_new_p): New declaration. 1321 * call-details.cc 1322 (call_details::deref_ptr_arg): New function. 1323 Dereference the argument at given index if possible. 1324 * call-details.h: Declaration of the above function. 1325 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall 1326 is recognized as a placement new. 1327 (kf_operator_delete::impl_call_post): Unbinding a region and its 1328 descendents now poisons with POISON_KIND_DELETED. 1329 (register_known_functions_lang_cp): Known function "operator 1330 delete" is now registered only once independently of its number of 1331 arguments. 1332 * region-model.cc (region_model::eval_condition): Now 1333 recursively calls itself if any of the operand is wrapped in a 1334 cast. 1335 * sm-malloc.cc (malloc_state_machine::on_stmt): 1336 Add placement new recognition. 1337 * svalue.cc (poison_kind_to_str): Wording for the new PK. 1338 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED. 1339 1340 2023-08-31 Francois-Xavier Coudert <fxcoudert (a] gcc.gnu.org> 1341 1342 * kf.cc: Change spelling to macOS. 1343 1344 2023-08-30 Eric Feng <ef2648 (a] columbia.edu> 1345 1346 PR analyzer/107646 1347 * engine.cc (impl_region_model_context::warn): New optional 1348 parameter. 1349 * exploded-graph.h (class impl_region_model_context): Likewise. 1350 * region-model.cc (region_model::pop_frame): New callback 1351 feature for region_model::pop_frame. 1352 * region-model.h (struct append_regions_cb_data): Likewise. 1353 (class region_model): Likewise. 1354 (class region_model_context): New optional parameter. 1355 (class region_model_context_decorator): Likewise. 1356 1357 2023-08-30 Francois-Xavier Coudert <fxcoudert (a] gcc.gnu.org> 1358 1359 * region-model.cc: Define INCLUDE_ALGORITHM. 1360 1361 2023-08-29 David Malcolm <dmalcolm (a] redhat.com> 1362 1363 PR analyzer/99860 1364 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 1365 selftest::analyzer_ranges_cc_tests. 1366 * analyzer-selftests.h (selftest::run_analyzer_selftests): New 1367 decl. 1368 * analyzer.opt (Wanalyzer-overlapping-buffers): New option. 1369 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h". 1370 (class overlapping_buffers): New. 1371 (call_details::complain_about_overlap): New. 1372 * call-details.h (call_details::complain_about_overlap): New decl. 1373 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call 1374 cd.complain_about_overlap for memcpy and memcpy_chk. 1375 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap. 1376 (kf_strcpy::impl_call_pre): Likewise. 1377 * ranges.cc: New file. 1378 * ranges.h: New file. 1379 1380 2023-08-29 David Malcolm <dmalcolm (a] redhat.com> 1381 1382 PR analyzer/105899 1383 * kf.cc (kf_strdup::impl_call_pre): Set size of 1384 dynamically-allocated buffer. Simulate copying the string from 1385 the source region to the new buffer. 1386 1387 2023-08-27 benjamin priour <vultkayn (a] gcc.gnu.org> 1388 1389 PR analyzer/96395 1390 * analyzer.h (class known_function): Add virtual casts 1391 to builtin_known_function. 1392 (class builtin_known_function): New subclass of known_function 1393 for builtins. 1394 * kf.cc (class kf_alloca): Now derived from 1395 builtin_known_function. 1396 (class kf_calloc): Likewise. 1397 (class kf_free): Likewise. 1398 (class kf_malloc): Likewise. 1399 (class kf_memcpy_memmove): Likewise. 1400 (class kf_memset): Likewise. 1401 (class kf_realloc): Likewise. 1402 (class kf_strchr): Likewise. 1403 (class kf_sprintf): Likewise. 1404 (class kf_strcat): Likewise. 1405 (class kf_strcpy): Likewise. 1406 (class kf_strdup): Likewise. 1407 (class kf_strlen): Likewise. 1408 (class kf_strndup): Likewise. 1409 (register_known_functions): Builtins are now registered as 1410 known_functions by name rather than by their BUILTIN_CODE. 1411 * known-function-manager.cc (get_normal_builtin): New overload. 1412 * known-function-manager.h: New overload declaration. 1413 * region-model.cc (region_model::get_builtin_kf): New function. 1414 * region-model.h (class region_model): Add declaration of 1415 get_builtin_kf. 1416 * sm-fd.cc: For called recognized as builtins, use the 1417 attributes of that builtin as defined in gcc/builtins.def 1418 rather than the user's. 1419 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise. 1420 1421 2023-08-25 David Malcolm <dmalcolm (a] redhat.com> 1422 1423 * access-diagram.cc (class string_region_spatial_item): Remove 1424 assumption that the string is written to the start of the cluster. 1425 1426 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1427 1428 PR analyzer/105899 1429 * call-details.cc 1430 (call_details::check_for_null_terminated_string_arg): Split into 1431 overloads, one taking just an arg_idx, the other a new 1432 "include_terminator" param. 1433 * call-details.h: Likewise. 1434 * kf.cc (class kf_strcat): New. 1435 (kf_strcpy::impl_call_pre): Update for change to 1436 check_for_null_terminated_string_arg. 1437 (register_known_functions): Register kf_strcat. 1438 * region-model.cc 1439 (region_model::check_for_null_terminated_string_arg): Split into 1440 overloads, one taking just an arg_idx, the other a new 1441 "include_terminator" param. When returning an svalue, handle 1442 "include_terminator" being false by subtracting one. 1443 * region-model.h 1444 (region_model::check_for_null_terminated_string_arg): Split into 1445 overloads, one taking just an arg_idx, the other a new 1446 "include_terminator" param. 1447 1448 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1449 1450 PR analyzer/105899 1451 * region-model.cc (fragment::has_null_terminator): Handle 1452 SK_BITS_WITHIN. 1453 1454 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1455 1456 PR analyzer/105899 1457 * region-model-manager.cc 1458 (region_model_manager::get_or_create_initial_value): Simplify 1459 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to 1460 CONSTANT_SVAL(STRING[N]). 1461 1462 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1463 1464 PR analyzer/105899 1465 * region-model.cc (fragment::has_null_terminator): Move STRING_CST 1466 handling to fragment::string_cst_has_null_terminator; also use it to 1467 handle INIT_VAL(STRING_REG). 1468 (fragment::string_cst_has_null_terminator): New, from above. 1469 1470 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1471 1472 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using 1473 region_model::copy_bytes. 1474 * region-model.cc (region_model::read_bytes): New. 1475 (region_model::copy_bytes): New. 1476 * region-model.h (region_model::read_bytes): New decl. 1477 (region_model::copy_bytes): New decl. 1478 1479 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1480 1481 PR analyzer/105899 1482 * region-model.cc (region_model::get_string_size): Delete both. 1483 * region-model.h (region_model::get_string_size): Delete both 1484 decls. 1485 1486 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1487 1488 PR analyzer/105899 1489 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using 1490 check_for_null_terminated_string_arg. 1491 * region-model.cc (region_model::get_store_bytes): Shortcut 1492 reading all of a string_region. 1493 (region_model::scan_for_null_terminator): Use get_store_value for 1494 the bytes rather than "unknown" when returning an unknown length. 1495 (region_model::write_bytes): New. 1496 * region-model.h (region_model::write_bytes): New decl. 1497 1498 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1499 1500 PR analyzer/105899 1501 * region-model.cc (iterable_cluster::iterable_cluster): Add 1502 symbolic binding keys to m_symbolic_bindings. 1503 (iterable_cluster::has_symbolic_bindings_p): New. 1504 (iterable_cluster::m_symbolic_bindings): New field. 1505 (region_model::scan_for_null_terminator): Treat clusters with 1506 symbolic bindings as having unknown strlen. 1507 1508 2023-08-24 David Malcolm <dmalcolm (a] redhat.com> 1509 1510 * engine.cc (impl_path_context::impl_path_context): Add logger 1511 param. 1512 (impl_path_context::bifurcate): Add log message. 1513 (impl_path_context::terminate_path): Likewise. 1514 (impl_path_context::m_logger): New field. 1515 (exploded_graph::process_node): Pass logger to path_ctxt ctor. 1516 1517 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1518 1519 PR analyzer/105899 1520 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc. 1521 (register_known_analyzer_functions): Use make_kf_strlen. 1522 * kf.cc (class kf_strlen::impl_call_pre): Replace with 1523 implementation of kf_analyzer_get_strlen from kf-analyzer.cc. 1524 Handle "UNKNOWN" return from check_for_null_terminated_string_arg 1525 by falling back to a conjured svalue. 1526 (make_kf_strlen): New. 1527 (register_known_functions): Use make_kf_strlen. 1528 * known-function-manager.h (make_kf_strlen): New decl. 1529 1530 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1531 1532 PR analyzer/105899 1533 * call-details.cc (call_details::call_details): New ctor. 1534 * call-details.h (call_details::call_details): New ctor decl. 1535 (struct call_arg_details): Move here from region-model.cc. 1536 * region-model.cc (region_model::check_call_format_attr): New. 1537 (region_model::check_call_args): Call it. 1538 (struct call_arg_details): Move it to call-details.h. 1539 * region-model.h (region_model::check_call_format_attr): New decl. 1540 1541 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1542 1543 * kf.cc (class kf_fopen): New. 1544 (register_known_functions): Register it. 1545 1546 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1547 1548 PR analyzer/105899 1549 * analyzer.opt (Wanalyzer-unterminated-string): Delete. 1550 * call-details.cc 1551 (call_details::check_for_null_terminated_string_arg): Convert 1552 return type from void to const svalue *. Add param "out_sval". 1553 * call-details.h 1554 (call_details::check_for_null_terminated_string_arg): Likewise. 1555 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up 1556 to result of check_for_null_terminated_string_arg. 1557 * region-model.cc (get_strlen): Delete. 1558 (class unterminated_string_arg): Delete. 1559 (struct fragment): New. 1560 (class iterable_cluster): New. 1561 (region_model::get_store_bytes): New. 1562 (get_tree_for_byte_offset): New. 1563 (region_model::scan_for_null_terminator): New. 1564 (region_model::check_for_null_terminated_string_arg): Convert 1565 return type from void to const svalue *. Add param "out_sval". 1566 Reimplement in terms of scan_for_null_terminator, dropping the 1567 special-case for -Wanalyzer-unterminated-string. 1568 * region-model.h (region_model::get_store_bytes): New decl. 1569 (region_model::scan_for_null_terminator): New decl. 1570 (region_model::check_for_null_terminated_string_arg): Convert 1571 return type from void to const svalue *. Add param "out_sval". 1572 * store.cc (concrete_binding::get_byte_range): New. 1573 * store.h (concrete_binding::get_byte_range): New decl. 1574 (store_manager::get_concrete_binding): New overload. 1575 1576 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1577 1578 * region-model.cc (region_model_context_decorator::add_event): 1579 Handle m_inner being NULL. 1580 * region-model.h (class region_model_context_decorator): Likewise. 1581 (annotating_context::warn): Likewise. 1582 1583 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1584 1585 * diagnostic-manager.cc (saved_diagnostic::add_event): New. 1586 (saved_diagnostic::add_any_saved_events): New. 1587 (diagnostic_manager::add_event): New. 1588 (dedupe_winners::emit_best): New. 1589 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param 1590 non-const. Call saved_diagnostic::add_any_saved_events. 1591 * diagnostic-manager.h (saved_diagnostic::add_event): New decl. 1592 (saved_diagnostic::add_any_saved_events): New decl. 1593 (saved_diagnostic::m_saved_events): New field. 1594 (diagnostic_manager::add_event): New decl. 1595 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param 1596 non-const. 1597 * engine.cc (impl_region_model_context::add_event): New. 1598 * exploded-graph.h (impl_region_model_context::add_event): New decl. 1599 * region-model.cc 1600 (noop_region_model_context::add_event): New. 1601 (region_model_context_decorator::add_event): New. 1602 * region-model.h (region_model_context::add_event): New vfunc. 1603 (noop_region_model_context::add_event): New decl. 1604 (region_model_context_decorator::add_event): New decl. 1605 1606 2023-08-22 David Malcolm <dmalcolm (a] redhat.com> 1607 1608 * region-model.cc 1609 (class check_external_function_for_access_attr::annotating_ctxt): 1610 Convert to an annotating_context. 1611 * region-model.h (class note_adding_context): Rename to... 1612 (class annotating_context): ...this, updating the "warn" method. 1613 (note_adding_context::make_note): Replace with... 1614 (annotating_context::add_annotations): ...this. 1615 1616 2023-08-14 benjamin priour <vultkayn (a] gcc.gnu.org> 1617 1618 PR analyzer/110543 1619 * analyzer.opt: Add new option. 1620 * diagnostic-manager.cc 1621 (diagnostic_manager::prune_path): Call prune_system_headers. 1622 (prune_frame): New function that deletes all events in a frame. 1623 (diagnostic_manager::prune_system_headers): New function. 1624 * diagnostic-manager.h: Add prune_system_headers declaration. 1625 1626 2023-08-11 David Malcolm <dmalcolm (a] redhat.com> 1627 1628 PR analyzer/105899 1629 * analyzer.opt (Wanalyzer-unterminated-string): New. 1630 * call-details.cc 1631 (call_details::check_for_null_terminated_string_arg): New. 1632 * call-details.h 1633 (call_details::check_for_null_terminated_string_arg): New decl. 1634 * kf-analyzer.cc (class kf_analyzer_get_strlen): New. 1635 (register_known_analyzer_functions): Register it. 1636 * kf.cc (kf_error::impl_call_pre): Check that format arg is a 1637 valid null-terminated string. 1638 (kf_putenv::impl_call_pre): Likewise for the sole param. 1639 (kf_strchr::impl_call_pre): Likewise for the first param. 1640 (kf_strcpy::impl_call_pre): Likewise for the second param. 1641 (kf_strdup::impl_call_pre): Likewise for the sole param. 1642 * region-model.cc (get_strlen): New. 1643 (struct call_arg_details): New. 1644 (inform_about_expected_null_terminated_string_arg): New. 1645 (class unterminated_string_arg): New. 1646 (region_model::check_for_null_terminated_string_arg): New. 1647 * region-model.h 1648 (region_model::check_for_null_terminated_string_arg): New decl. 1649 1650 2023-08-11 Eric Feng <ef2648 (a] columbia.edu> 1651 1652 PR analyzer/107646 1653 * call-details.h: New function. 1654 * region-model.cc (region_model::get_or_create_region_for_heap_alloc): 1655 New optional parameters. 1656 * region-model.h (class region_model): New optional parameters. 1657 * sm-malloc.cc (on_realloc_with_move): New function. 1658 (region_model::transition_ptr_sval_non_null): New function. 1659 1660 2023-08-09 David Malcolm <dmalcolm (a] redhat.com> 1661 1662 * analyzer.h (class pure_known_function_with_default_return): New 1663 subclass. 1664 * call-details.cc (const_fn_p): Move here from region-model.cc. 1665 (maybe_get_const_fn_result): Likewise. 1666 (get_result_size_in_bytes): Likewise. 1667 (call_details::set_any_lhs_with_defaults): New function, based on 1668 code in region_model::on_call_pre. 1669 * call-details.h (call_details::set_any_lhs_with_defaults): New 1670 decl. 1671 * diagnostic-manager.cc 1672 (diagnostic_manager::emit_saved_diagnostic): Log the index of the 1673 saved_diagnostic. 1674 * kf.cc (pure_known_function_with_default_return::impl_call_pre): 1675 New. 1676 (kf_memset::impl_call_pre): Set the LHS to the first param. 1677 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults. 1678 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults. 1679 (class kf_stack_restore): Derive from 1680 pure_known_function_with_default_return. 1681 (class kf_stack_save): Likewise. 1682 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults. 1683 * region-model-reachability.cc (reachable_regions::handle_sval): 1684 Remove logic for symbolic regions for pointers. 1685 * region-model.cc (region_model::canonicalize): Remove purging of 1686 dynamic extents workaround for surplus values from 1687 region_model::on_call_pre's default LHS code. 1688 (const_fn_p): Move to call-details.cc. 1689 (maybe_get_const_fn_result): Likewise. 1690 (get_result_size_in_bytes): Likewise. 1691 (region_model::update_for_nonzero_return): Call 1692 cd.set_any_lhs_with_defaults. 1693 (region_model::on_call_pre): Remove the assignment to the LHS of a 1694 default return value, instead requiring all known_function 1695 implementations to write to any LHS of the call. Use 1696 cd.set_any_lhs_with_defaults on the non-kf paths. 1697 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use 1698 cd.set_any_lhs_with_defaults when failing to get at fd state. 1699 (kf_bind::outcome_of_bind::update_model): Likewise. 1700 (kf_listen::outcome_of_listen::update_model): Likewise. 1701 (kf_accept::outcome_of_accept::update_model): Likewise. 1702 (kf_connect::outcome_of_connect::update_model): Likewise. 1703 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults. 1704 * sm-file.cc (class kf_stdio_output_fn): Derive from 1705 pure_known_function_with_default_return. 1706 (class kf_ferror): Likewise. 1707 (class kf_fileno): Likewise. 1708 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults. 1709 (kf_read::impl_call_pre): Likewise. 1710 (class kf_getc): Derive from 1711 pure_known_function_with_default_return. 1712 (class kf_getchar): Likewise. 1713 * varargs.cc (kf_va_arg::impl_call_pre): Use 1714 cd.set_any_lhs_with_defaults. 1715 1716 2023-08-04 David Malcolm <dmalcolm (a] redhat.com> 1717 1718 PR analyzer/110426 1719 * bounds-checking.cc (region_model::check_region_bounds): Handle 1720 symbolic base regions. 1721 * call-details.cc: Include "stringpool.h" and "attribs.h". 1722 (call_details::lookup_function_attribute): New function. 1723 * call-details.h (call_details::lookup_function_attribute): New 1724 function decl. 1725 * region-model-manager.cc 1726 (region_model_manager::maybe_fold_binop): Add reference to 1727 PR analyzer/110902. 1728 * region-model-reachability.cc (reachable_regions::handle_sval): 1729 Add symbolic regions for pointers that are conjured svalues for 1730 the LHS of a stmt. 1731 * region-model.cc (region_model::canonicalize): Purge dynamic 1732 extents for regions that aren't referenced. 1733 (get_result_size_in_bytes): New function. 1734 (region_model::on_call_pre): Use get_result_size_in_bytes and 1735 potentially set the dynamic extents of the region pointed to by 1736 the return value. 1737 (region_model::deref_rvalue): Add param "add_nonnull_constraint" 1738 and use it to conditionalize adding the constraint. 1739 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt" 1740 param to both ctors and use it to initialize new "m_stmt" field. 1741 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use 1742 m_lhs or m_rhs. 1743 (pending_diagnostic_subclass::m_stmt): New field. 1744 (region_model::check_region_size): Generalize to any kind of 1745 pointer svalue by using deref_rvalue rather than checking for 1746 region_svalue. Pass stmt to dubious_allocation_size ctor. 1747 * region-model.h (region_model::deref_rvalue): Add param 1748 "add_nonnull_constraint". 1749 * svalue.cc (conjured_svalue::lhs_value_p): New function. 1750 * svalue.h (conjured_svalue::lhs_value_p): New decl. 1751 1752 2023-08-04 David Malcolm <dmalcolm (a] redhat.com> 1753 1754 * svalue.cc (region_svalue::dump_to_pp): Support NULL type. 1755 (constant_svalue::dump_to_pp): Likewise. 1756 (initial_svalue::dump_to_pp): Likewise. 1757 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the 1758 type. 1759 1760 2023-08-03 David Malcolm <dmalcolm (a] redhat.com> 1761 1762 PR analyzer/110882 1763 * region.cc (int_size_in_bits): Fail on zero-sized types. 1764 1765 2023-08-02 Eric Feng <ef2648 (a] columbia.edu> 1766 1767 PR analyzer/107646 1768 * analyzer-language.cc (run_callbacks): New function. 1769 (on_finish_translation_unit): New function. 1770 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include. 1771 (class translation_unit): New vfuncs. 1772 1773 2023-07-26 David Malcolm <dmalcolm (a] redhat.com> 1774 1775 PR analyzer/104940 1776 * region-model-manager.cc 1777 (region_model_manager::region_model_manager): Update for 1778 generalizing region ids to also cover svalues. 1779 (region_model_manager::get_or_create_constant_svalue): Likewise. 1780 (region_model_manager::get_or_create_unknown_svalue): Likewise. 1781 (region_model_manager::create_unique_svalue): Likewise. 1782 (region_model_manager::get_or_create_initial_value): Likewise. 1783 (region_model_manager::get_or_create_setjmp_svalue): Likewise. 1784 (region_model_manager::get_or_create_poisoned_svalue): Likewise. 1785 (region_model_manager::get_ptr_svalue): Likewise. 1786 (region_model_manager::get_or_create_unaryop): Likewise. 1787 (region_model_manager::get_or_create_binop): Likewise. 1788 (region_model_manager::get_or_create_sub_svalue): Likewise. 1789 (region_model_manager::get_or_create_repeated_svalue): Likewise. 1790 (region_model_manager::get_or_create_bits_within): Likewise. 1791 (region_model_manager::get_or_create_unmergeable): Likewise. 1792 (region_model_manager::get_or_create_widening_svalue): Likewise. 1793 (region_model_manager::get_or_create_compound_svalue): Likewise. 1794 (region_model_manager::get_or_create_conjured_svalue): Likewise. 1795 (region_model_manager::get_or_create_asm_output_svalue): Likewise. 1796 (region_model_manager::get_or_create_const_fn_result_svalue): 1797 Likewise. 1798 (region_model_manager::get_region_for_fndecl): Likewise. 1799 (region_model_manager::get_region_for_label): Likewise. 1800 (region_model_manager::get_region_for_global): Likewise. 1801 (region_model_manager::get_field_region): Likewise. 1802 (region_model_manager::get_element_region): Likewise. 1803 (region_model_manager::get_offset_region): Likewise. 1804 (region_model_manager::get_sized_region): Likewise. 1805 (region_model_manager::get_cast_region): Likewise. 1806 (region_model_manager::get_frame_region): Likewise. 1807 (region_model_manager::get_symbolic_region): Likewise. 1808 (region_model_manager::get_region_for_string): Likewise. 1809 (region_model_manager::get_bit_range): Likewise. 1810 (region_model_manager::get_var_arg_region): Likewise. 1811 (region_model_manager::get_region_for_unexpected_tree_code): 1812 Likewise. 1813 (region_model_manager::get_or_create_region_for_heap_alloc): 1814 Likewise. 1815 (region_model_manager::create_region_for_alloca): Likewise. 1816 (region_model_manager::log_stats): Likewise. 1817 * region-model-manager.h (region_model_manager::get_num_regions): 1818 Replace with... 1819 (region_model_manager::get_num_symbols): ...this. 1820 (region_model_manager::alloc_region_id): Replace with... 1821 (region_model_manager::alloc_symbol_id): ...this. 1822 (region_model_manager::m_next_region_id): Replace with... 1823 (region_model_manager::m_next_symbol_id): ...this. 1824 * region-model.cc (selftest::test_get_representative_tree): Update 1825 for generalizing region ids to also cover svalues. 1826 (selftest::test_binop_svalue_folding): Likewise. 1827 (selftest::test_state_merging): Likewise. 1828 * region.cc (region::cmp_ids): Delete, in favor of 1829 symbol::cmp_ids. 1830 (region::region): Update for introduction of symbol base class. 1831 (frame_region::get_region_for_local): Likewise. 1832 (root_region::root_region): Likewise. 1833 (symbolic_region::symbolic_region): Likewise. 1834 * region.h: Replace include of "analyzer/complexity.h" with 1835 "analyzer/symbol.h". 1836 (class region): Make a subclass of symbol. 1837 (region::get_id): Delete in favor of symbol::get_id. 1838 (region::cmp_ids): Delete in favor of symbol::cmp_ids. 1839 (region::get_complexity): Delete in favor of 1840 symbol::get_complexity. 1841 (region::region): Use symbol::id_t for "id" param. 1842 (region::m_complexity): Move field to symbol base class. 1843 (region::m_id): Likewise. 1844 (space_region::space_region): Use symbol::id_t for "id" param. 1845 (frame_region::frame_region): Likewise. 1846 (globals_region::globals_region): Likewise. 1847 (code_region::code_region): Likewise. 1848 (function_region::function_region): Likewise. 1849 (label_region::label_region): Likewise. 1850 (stack_region::stack_region): Likewise. 1851 (heap_region::heap_region): Likewise. 1852 (thread_local_region::thread_local_region): Likewise. 1853 (root_region::root_region): Likewise. 1854 (symbolic_region::symbolic_region): Likewise. 1855 (decl_region::decl_region): Likewise. 1856 (field_region::field_region): Likewise. 1857 (element_region::element_region): Likewise. 1858 (offset_region::offset_region): Likewise. 1859 (sized_region::sized_region): Likewise. 1860 (cast_region::cast_region): Likewise. 1861 (heap_allocated_region::heap_allocated_region): Likewise. 1862 (alloca_region::alloca_region): Likewise. 1863 (string_region::string_region): Likewise. 1864 (bit_range_region::bit_range_region): Likewise. 1865 (var_arg_region::var_arg_region): Likewise. 1866 (errno_region::errno_region): Likewise. 1867 (unknown_region::unknown_region): Likewise. 1868 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param. 1869 (repeated_svalue::repeated_svalue): Likewise. 1870 (bits_within_svalue::bits_within_svalue): Likewise. 1871 (compound_svalue::compound_svalue): Likewise. 1872 * svalue.h: Replace include of "analyzer/complexity.h" with 1873 "analyzer/symbol.h". 1874 (class svalue): Make a subclass of symbol. 1875 (svalue::get_complexity): Delete in favor of 1876 symbol::get_complexity. 1877 (svalue::svalue): Add symbol::id_t param. Update for new base 1878 class. 1879 (svalue::m_complexity): Delete in favor of 1880 symbol::m_complexity. 1881 (region_svalue::region_svalue): Add symbol::id_t param 1882 (constant_svalue::constant_svalue): Likewise. 1883 (unknown_svalue::unknown_svalue): Likewise. 1884 (poisoned_svalue::poisoned_svalue): Likewise. 1885 (setjmp_svalue::setjmp_svalue): Likewise. 1886 (initial_svalue::initial_svalue): Likewise. 1887 (unaryop_svalue::unaryop_svalue): Likewise. 1888 (binop_svalue::binop_svalue): Likewise. 1889 (sub_svalue::sub_svalue): Likewise. 1890 (repeated_svalue::repeated_svalue): Likewise. 1891 (bits_within_svalue::bits_within_svalue): Likewise. 1892 (unmergeable_svalue::unmergeable_svalue): Likewise. 1893 (placeholder_svalue::placeholder_svalue): Likewise. 1894 (widening_svalue::widening_svalue): Likewise. 1895 (compound_svalue::compound_svalue): Likewise. 1896 (conjured_svalue::conjured_svalue): Likewise. 1897 (asm_output_svalue::asm_output_svalue): Likewise. 1898 (const_fn_result_svalue::const_fn_result_svalue): Likewise. 1899 * symbol.cc: New file. 1900 * symbol.h: New file. 1901 1902 2023-07-21 David Malcolm <dmalcolm (a] redhat.com> 1903 1904 PR analyzer/110455 1905 * region-model.cc (region_model::get_gassign_result): Only check 1906 for bad shift counts when dealing with an integral type. 1907 1908 2023-07-21 David Malcolm <dmalcolm (a] redhat.com> 1909 1910 PR analyzer/110433 1911 PR middle-end/110612 1912 * access-diagram.cc (class spatial_item): Add virtual dtor. 1913 1914 2023-07-21 David Malcolm <dmalcolm (a] redhat.com> 1915 1916 PR analyzer/110387 1917 * region.h (struct cast_region::key_t): Support "m_type" being 1918 null by using "m_original_region" for empty/deleted slots. 1919 1920 2023-07-19 David Malcolm <dmalcolm (a] redhat.com> 1921 1922 PR analyzer/110700 1923 * region-model-manager.cc 1924 (region_model_manager::get_or_create_int_cst): Assert that we have 1925 an integral or pointer type. 1926 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor): 1927 Don't check non-integral types. 1928 1929 2023-06-29 benjamin priour <priour.be (a] gmail.com> 1930 1931 PR analyzer/110198 1932 * region-model-manager.cc 1933 (region_model_manager::get_or_create_initial_value): Take an 1934 optional boolean value to bypass poisoning checks 1935 * region-model-manager.h: Update declaration of the above function. 1936 * region-model.cc (region_model::get_store_value): No longer returns 1937 on OOB, but rather gives a boolean to get_or_create_initial_value. 1938 (region_model::check_region_access): Update docstring. 1939 (region_model::check_region_for_write): Update docstring. 1940 1941 2023-06-24 David Malcolm <dmalcolm (a] redhat.com> 1942 1943 * access-diagram.cc: Add #define INCLUDE_VECTOR. 1944 * bounds-checking.cc: Likewise. 1945 1946 2023-06-22 David Malcolm <dmalcolm (a] redhat.com> 1947 1948 PR analyzer/106626 1949 * access-diagram.cc: New file. 1950 * access-diagram.h: New file. 1951 * analyzer.h (class region_offset): Add default ctor. 1952 (region_offset::make_byte_offset): New decl. 1953 (region_offset::concrete_p): New. 1954 (region_offset::get_concrete_byte_offset): New. 1955 (region_offset::calc_symbolic_bit_offset): New decl. 1956 (region_offset::calc_symbolic_byte_offset): New decl. 1957 (region_offset::dump_to_pp): New decl. 1958 (region_offset::dump): New decl. 1959 (operator<, operator<=, operator>, operator>=): New decls for 1960 region_offset. 1961 * analyzer.opt 1962 (-param=analyzer-text-art-string-ellipsis-threshold=): New. 1963 (-param=analyzer-text-art-string-ellipsis-head-len=): New. 1964 (-param=analyzer-text-art-string-ellipsis-tail-len=): New. 1965 (-param=analyzer-text-art-ideal-canvas-width=): New. 1966 (fanalyzer-debug-text-art): New. 1967 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h", 1968 and "analyzer/access-diagram.h". 1969 (class out_of_bounds::oob_region_creation_event_capacity): New. 1970 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint" 1971 params. 1972 (out_of_bounds::mark_interesting_stuff): Use the base region. 1973 (out_of_bounds::add_region_creation_events): Use 1974 oob_region_creation_event_capacity. 1975 (out_of_bounds::get_dir): New pure vfunc. 1976 (out_of_bounds::maybe_show_notes): New. 1977 (out_of_bounds::maybe_show_diagram): New. 1978 (out_of_bounds::make_access_diagram): New. 1979 (out_of_bounds::m_model): New field. 1980 (out_of_bounds::m_sval_hint): New field. 1981 (out_of_bounds::m_region_creation_event_id): New field. 1982 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new 1983 fields. 1984 (concrete_past_the_end::concrete_past_the_end): Likewise. 1985 (concrete_past_the_end::add_region_creation_events): Use 1986 oob_region_creation_event_capacity. 1987 (concrete_buffer_overflow::concrete_buffer_overflow): Update for 1988 new fields. 1989 (concrete_buffer_overflow::emit): Replace call to 1990 maybe_describe_array_bounds with maybe_show_notes. 1991 (concrete_buffer_overflow::get_dir): New. 1992 (concrete_buffer_over_read::concrete_buffer_over_read): Update for 1993 new fields. 1994 (concrete_buffer_over_read::emit): Replace call to 1995 maybe_describe_array_bounds with maybe_show_notes. 1996 (concrete_buffer_overflow::get_dir): New. 1997 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update 1998 for new fields. 1999 (concrete_buffer_underwrite::emit): Replace call to 2000 maybe_describe_array_bounds with maybe_show_notes. 2001 (concrete_buffer_underwrite::get_dir): New. 2002 (concrete_buffer_under_read::concrete_buffer_under_read): Update 2003 for new fields. 2004 (concrete_buffer_under_read::emit): Replace call to 2005 maybe_describe_array_bounds with maybe_show_notes. 2006 (concrete_buffer_under_read::get_dir): New. 2007 (symbolic_past_the_end::symbolic_past_the_end): Update for new 2008 fields. 2009 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise. 2010 (symbolic_buffer_overflow::emit): Call maybe_show_notes. 2011 (symbolic_buffer_overflow::get_dir): New. 2012 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for 2013 new fields. 2014 (symbolic_buffer_over_read::emit): Call maybe_show_notes. 2015 (symbolic_buffer_over_read::get_dir): New. 2016 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass 2017 it and sized_offset_reg to diagnostics. 2018 (region_model::check_region_bounds): Add "sval_hint" param, passing 2019 it to diagnostics. 2020 * diagnostic-manager.cc 2021 (diagnostic_manager::emit_saved_diagnostic): Pass logger to 2022 pending_diagnostic::emit. 2023 * engine.cc: Add logger param to pending_diagnostic::emit 2024 implementations. 2025 * infinite-recursion.cc: Likewise. 2026 * kf-analyzer.cc: Likewise. 2027 * kf.cc: Likewise. Add nullptr for new param of 2028 check_region_for_write. 2029 * pending-diagnostic.h: Likewise in decl. 2030 * region-model-manager.cc 2031 (region_model_manager::get_or_create_int_cst): Convert param from 2032 poly_int64 to const poly_wide_int_ref &. 2033 (region_model_manager::maybe_fold_binop): Support type being NULL 2034 when checking for floating-point types. 2035 Check for (X + Y) - X => Y. Be less strict about types when folding 2036 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST). 2037 * region-model-manager.h 2038 (region_model_manager::get_or_create_int_cst): Convert param from 2039 poly_int64 to const poly_wide_int_ref &. 2040 * region-model.cc: Add logger param to pending_diagnostic::emit 2041 implementations. 2042 (region_model::check_external_function_for_access_attr): Update 2043 for new param of check_region_for_write. 2044 (region_model::deref_rvalue): Use nullptr rather than NULL. 2045 (region_model::get_capacity): Handle RK_STRING. 2046 (region_model::check_region_access): Add "sval_hint" param; pass it to 2047 check_region_bounds. 2048 (region_model::check_region_for_write): Add "sval_hint" param; 2049 pass it to check_region_access. 2050 (region_model::check_region_for_read): Add NULL for new param to 2051 check_region_access. 2052 (region_model::set_value): Pass rhs_sval to 2053 check_region_for_write. 2054 (region_model::get_representative_path_var_1): Handle SK_CONSTANT 2055 in the check for infinite recursion. 2056 * region-model.h (region_model::check_region_for_write): Add 2057 "sval_hint" param. 2058 (region_model::check_region_access): Likewise. 2059 (region_model::check_symbolic_bounds): Likewise. 2060 (region_model::check_region_bounds): Likewise. 2061 * region.cc (region_offset::make_byte_offset): New. 2062 (region_offset::calc_symbolic_bit_offset): New. 2063 (region_offset::calc_symbolic_byte_offset): New. 2064 (region_offset::dump_to_pp): New. 2065 (region_offset::dump): New. 2066 (struct linear_op): New. 2067 (operator<, operator<=, operator>, operator>=): New, for 2068 region_offset. 2069 (region::get_next_offset): New. 2070 (region::get_relative_symbolic_offset): Use ptrdiff_type_node. 2071 (field_region::get_relative_symbolic_offset): Likewise. 2072 (element_region::get_relative_symbolic_offset): Likewise. 2073 (bit_range_region::get_relative_symbolic_offset): Likewise. 2074 * region.h (region::get_next_offset): New decl. 2075 * sm-fd.cc: Add logger param to pending_diagnostic::emit 2076 implementations. 2077 * sm-file.cc: Likewise. 2078 * sm-malloc.cc: Likewise. 2079 * sm-pattern-test.cc: Likewise. 2080 * sm-sensitive.cc: Likewise. 2081 * sm-signal.cc: Likewise. 2082 * sm-taint.cc: Likewise. 2083 * store.cc (bit_range::contains_p): Allow "out" to be null. 2084 * store.h (byte_range::get_start_bit_offset): New. 2085 (byte_range::get_next_bit_offset): New. 2086 * varargs.cc: Add logger param to pending_diagnostic::emit 2087 implementations. 2088 2089 2023-06-10 Tim Lange <mail (a] tim-lange.me> 2090 2091 PR analyzer/109577 2092 * constraint-manager.cc (class sval_finder): Visitor to find 2093 childs in svalue trees. 2094 (constraint_manager::sval_constrained_p): Add new function to 2095 check whether a sval might be part of an constraint. 2096 * constraint-manager.h: Add sval_constrained_p function. 2097 * region-model.cc (class size_visitor): Reverse behavior to not 2098 emit a warning on not explicitly considered cases. 2099 (region_model::check_region_size): 2100 Adapt to size_visitor changes. 2101 2102 2023-06-09 David Malcolm <dmalcolm (a] redhat.com> 2103 2104 PR analyzer/110112 2105 * region-model.cc (region_model::get_initial_value_for_global): 2106 Move code to region::calc_initial_value_at_main. 2107 * region.cc (region::get_initial_value_at_main): New function. 2108 (region::calc_initial_value_at_main): New function, based on code 2109 in region_model::get_initial_value_for_global. 2110 (region::region): Initialize m_cached_init_sval_at_main. 2111 (decl_region::get_svalue_for_constructor): Add a cache, splitting 2112 out body to... 2113 (decl_region::calc_svalue_for_constructor): ...this new function. 2114 * region.h (region::get_initial_value_at_main): New decl. 2115 (region::calc_initial_value_at_main): New decl. 2116 (region::m_cached_init_sval_at_main): New field. 2117 (decl_region::decl_region): Initialize m_ctor_svalue. 2118 (decl_region::calc_svalue_for_constructor): New decl. 2119 (decl_region::m_ctor_svalue): New field. 2120 2121 2023-06-08 Benjamin Priour <vultkayn (a] gcc.gnu.org> 2122 2123 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG 2124 region access was OOB. 2125 (region_model::check_region_bounds): Likewise. 2126 * region-model.cc (region_model::get_store_value): Creates an 2127 unknown svalue on OOB-read access to REG. 2128 (region_model::check_region_access): Returns whether an unknown svalue needs be created. 2129 (region_model::check_region_for_read): Passes check_region_access return value. 2130 * region-model.h: Update prior function definitions. 2131 2132 2023-06-02 David Malcolm <dmalcolm (a] redhat.com> 2133 2134 PR analyzer/109015 2135 * kf.cc (class kf_atomic_exchange): New. 2136 (class kf_atomic_exchange_n): New. 2137 (class kf_atomic_fetch_op): New. 2138 (class kf_atomic_op_fetch): New. 2139 (class kf_atomic_load): New. 2140 (class kf_atomic_load_n): New. 2141 (class kf_atomic_store_n): New. 2142 (register_atomic_builtins): New function. 2143 (register_known_functions): Call register_atomic_builtins. 2144 2145 2023-06-02 David Malcolm <dmalcolm (a] redhat.com> 2146 2147 * store.cc (store::eval_alias_1): Regions in different memory 2148 spaces can't alias. 2149 2150 2023-05-18 Bernhard Reutner-Fischer <aldot (a] gcc.gnu.org> 2151 2152 * region-model-manager.cc (get_code_for_cast): Use _P defines from 2153 tree.h. 2154 (region_model_manager::get_or_create_cast): Ditto. 2155 (region_model_manager::get_region_for_global): Ditto. 2156 * region-model.cc (region_model::get_lvalue_1): Ditto. 2157 * region.cc (decl_region::maybe_get_constant_value): Ditto. 2158 2159 2023-03-22 David Malcolm <dmalcolm (a] redhat.com> 2160 2161 PR analyzer/109239 2162 * program-point.cc: Include "analyzer/inlining-iterator.h". 2163 (program_point::effectively_intraprocedural_p): New function. 2164 * program-point.h (program_point::effectively_intraprocedural_p): 2165 New decl. 2166 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting 2167 interprocedural cases, so that we reject interprocedural cases 2168 that have become intraprocedural due to inlining. 2169 2170 2023-03-18 David Malcolm <dmalcolm (a] redhat.com> 2171 2172 PR analyzer/109094 2173 * region-model.cc (region_model::on_longjmp): Pass false for 2174 new "eval_return_svalue" param of pop_frame. 2175 (region_model::pop_frame): Add new "eval_return_svalue" param and 2176 use it to suppress the call to get_rvalue on the result when 2177 needed by on_longjmp. 2178 * region-model.h (region_model::pop_frame): Add new 2179 "eval_return_svalue" param. 2180 2181 2023-03-10 David Malcolm <dmalcolm (a] redhat.com> 2182 2183 PR analyzer/109059 2184 * region-model.cc (region_model::mark_region_as_unknown): Gather a 2185 set of maybe-live svalues and call on_maybe_live_values with it. 2186 * store.cc (binding_map::remove_overlapping_bindings): Add new 2187 "maybe_live_values" param; add any removed svalues to it. 2188 (binding_cluster::clobber_region): Add NULL as new param of 2189 remove_overlapping_bindings. 2190 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values" 2191 param and pass it to remove_overlapping_bindings. 2192 (binding_cluster::maybe_get_compound_binding): Add NULL for new 2193 param of binding_map::remove_overlapping_bindings. 2194 (binding_cluster::remove_overlapping_bindings): Add 2195 "maybe_live_values" param and pass to 2196 binding_map::remove_overlapping_bindings. 2197 (store::set_value): Capture a set of maybe-live svalues, and call 2198 on_maybe_live_values with it. 2199 (store::on_maybe_live_values): New. 2200 (store::mark_region_as_unknown): Add "maybe_live_values" param 2201 and pass it to binding_cluster::mark_region_as_unknown. 2202 (store::remove_overlapping_bindings): Pass NULL for new param of 2203 binding_cluster::remove_overlapping_bindings. 2204 * store.h (binding_map::remove_overlapping_bindings): Add 2205 "maybe_live_values" param. 2206 (binding_cluster::mark_region_as_unknown): Likewise. 2207 (binding_cluster::remove_overlapping_bindings): Likewise. 2208 (store::mark_region_as_unknown): Likewise. 2209 (store::on_maybe_live_values): New decl. 2210 2211 2023-03-10 David Malcolm <dmalcolm (a] redhat.com> 2212 2213 PR analyzer/108475 2214 PR analyzer/109060 2215 * sm-malloc.cc (deref_before_check::deref_before_check): 2216 Initialize new field m_deref_expr. Assert that arg is non-NULL. 2217 (deref_before_check::emit): Reject cases where the spelling of the 2218 thing that was dereferenced differs from that of what is checked, 2219 or if the dereference expression was not found. Remove code to 2220 handle NULL m_arg. 2221 (deref_before_check::describe_state_change): Remove code to handle 2222 NULL m_arg. 2223 (deref_before_check::describe_final_event): Likewise. 2224 (deref_before_check::sufficiently_similar_p): New. 2225 (deref_before_check::m_deref_expr): New field. 2226 (malloc_state_machine::maybe_complain_about_deref_before_check): 2227 Don't warn if the diag_ptr is NULL. 2228 2229 2023-03-03 David Malcolm <dmalcolm (a] redhat.com> 2230 2231 * kf.cc (class kf_sprintf): New. 2232 (register_known_functions): Register it. 2233 2234 2023-03-02 David Malcolm <dmalcolm (a] redhat.com> 2235 2236 PR analyzer/108968 2237 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs 2238 with a DECL_HARD_REGISTER by returning UNKNOWN. 2239 2240 2023-03-02 Hans-Peter Nilsson <hp (a] axis.com> 2241 2242 * kf.cc (register_known_functions): Add __errno function for newlib. 2243 2244 2023-03-01 David Malcolm <dmalcolm (a] redhat.com> 2245 2246 PR analyzer/107565 2247 * region-model.cc (region_model::on_call_pre): Flatten logic by 2248 returning early. Consolidate logic for detecting const and pure 2249 functions. When considering whether an unhandled built-in 2250 function has side-effects, consider all kinds of builtin, rather 2251 than just BUILT_IN_NORMAL, and don't require 2252 gimple_builtin_call_types_compatible_p. 2253 2254 2023-03-01 David Malcolm <dmalcolm (a] redhat.com> 2255 2256 PR analyzer/108935 2257 * infinite-recursion.cc (contains_unknown_p): New. 2258 (sufficiently_different_region_binding_p): New function, splitting 2259 out inner loop from... 2260 (sufficiently_different_p): ...here. Extend detection of unknown 2261 svalues to also include svalues that contain unknown. Treat 2262 changes in frames below the entry to the recursion as being 2263 sufficiently different to reject being an infinite recursion. 2264 2265 2023-02-21 David Malcolm <dmalcolm (a] redhat.com> 2266 2267 PR analyzer/108830 2268 * analyzer.opt (fanalyzer-suppress-followups): New option. 2269 * engine.cc (impl_region_model_context::warn): Terminate the path 2270 if the diagnostic's terminate_path_p vfunc returns true and 2271 -fanalyzer-suppress-followups is true (the default). 2272 (impl_sm_context::warn): Likewise, for both overloads. 2273 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New 2274 vfunc. 2275 * program-state.cc (program_state::on_edge): Terminate the path if 2276 the ctxt requests it during updating the edge. 2277 * region-model.cc (poisoned_value_diagnostic::terminate_path_p): 2278 New vfunc. 2279 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc. 2280 (null_arg::terminate_path_p): New vfunc. 2281 2282 2023-02-16 David Malcolm <dmalcolm (a] redhat.com> 2283 2284 PR analyzer/108806 2285 * constraint-manager.cc (bounded_range::dump_to_pp): Use 2286 bounded_range::singleton_p. 2287 (constraint_manager::add_bounded_ranges): Handle singleton ranges 2288 by adding an EQ_EXPR constraint. 2289 (constraint_manager::impossible_derived_conditions_p): New. 2290 (constraint_manager::eval_condition): Reject EQ_EXPR when it would 2291 imply impossible derived conditions. 2292 (selftest::test_bits): New. 2293 (selftest::run_constraint_manager_tests): Run it. 2294 * constraint-manager.h (bounded_range::singleton_p): New. 2295 (constraint_manager::impossible_derived_conditions_p): New decl. 2296 * region-model.cc (region_model::get_rvalue_1): Handle 2297 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR. 2298 2299 2023-02-15 David Malcolm <dmalcolm (a] redhat.com> 2300 2301 PR analyzer/108664 2302 PR analyzer/108666 2303 PR analyzer/108725 2304 * diagnostic-manager.cc (epath_finder::get_best_epath): Add 2305 "target_stmt" param. 2306 (epath_finder::explore_feasible_paths): Likewise. 2307 (epath_finder::process_worklist_item): Likewise. 2308 (saved_diagnostic::calc_best_epath): Pass m_stmt to 2309 epath_finder::get_best_epath. 2310 * engine.cc (feasibility_state::maybe_update_for_edge): Move 2311 per-stmt logic to... 2312 (feasibility_state::update_for_stmt): ...this new function. 2313 * exploded-graph.h (feasibility_state::update_for_stmt): New decl. 2314 * feasible-graph.cc (feasible_node::get_state_at_stmt): New. 2315 * feasible-graph.h: Include "analyzer/exploded-graph.h". 2316 (feasible_node::get_state_at_stmt): New decl. 2317 * infinite-recursion.cc 2318 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for 2319 vfunc signature change. 2320 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p): 2321 Convert first param to a reference. Add stmt param. 2322 * region-model.cc: Include "analyzer/feasible-graph.h". 2323 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add 2324 "check_expr" param. 2325 (poisoned_value_diagnostic::check_valid_fpath_p): New. 2326 (poisoned_value_diagnostic::m_check_expr): New field. 2327 (region_model::check_for_poison): Attempt to supply a check_expr 2328 to the diagnostic 2329 (region_model::deref_rvalue): Add NULL for new check_expr param 2330 of poisoned_value_diagnostic. 2331 (region_model::get_or_create_region_for_heap_alloc): Don't reuse 2332 regions that are marked as TOUCHED. 2333 2334 2023-02-10 David Malcolm <dmalcolm (a] redhat.com> 2335 2336 PR analyzer/108745 2337 * sm-malloc.cc (deref_before_check::emit): Reject the warning if 2338 the check occurs within a macro defintion. 2339 2340 2023-02-09 David Malcolm <dmalcolm (a] redhat.com> 2341 2342 PR analyzer/108733 2343 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR 2344 and MEM_REF. 2345 2346 2023-02-08 David Malcolm <dmalcolm (a] redhat.com> 2347 2348 PR analyzer/108704 2349 * state-purge.cc (state_purge_per_decl::process_point_backwards): 2350 Don't stop processing the decl if it's fully overwritten by 2351 this stmt if it's also used by this stmt. 2352 2353 2023-02-07 David Malcolm <dmalcolm (a] redhat.com> 2354 2355 PR analyzer/108661 2356 * sm-fd.cc (class kf_read): New. 2357 (register_known_fd_functions): Register "read". 2358 * sm-file.cc (class kf_fread): Update comment. 2359 2360 2023-02-02 David Malcolm <dmalcolm (a] redhat.com> 2361 2362 PR analyzer/108633 2363 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing 2364 "continue". 2365 (fd_state_machine::on_listen): Don't issue phase-mismatch or 2366 type-mismatch warnings for the "invalid" state. 2367 2368 2023-02-01 David Malcolm <dmalcolm (a] redhat.com> 2369 2370 PR analyzer/108616 2371 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca" 2372 to macros that we shouldn't unwind inside. 2373 2374 2023-01-26 David Malcolm <dmalcolm (a] redhat.com> 2375 2376 PR analyzer/108524 2377 * analyzer.h (class feasible_node): New forward decl. 2378 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd" 2379 param. 2380 (epath_finder::explore_feasible_paths): Likewise. 2381 (epath_finder::process_worklist_item): Likewise. Use it to call 2382 pending_diagnostic::check_valid_fpath_p on the final fpath to 2383 give pending_diagnostic a way to add additional restrictions on 2384 feasibility. 2385 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to 2386 epath_finder::get_best_epath. 2387 * infinite-recursion.cc: Include "analyzer/feasible-graph.h". 2388 (infinite_recursion_diagnostic::check_valid_fpath_p): New. 2389 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New. 2390 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New. 2391 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p): 2392 New vfunc. 2393 2394 2023-01-19 David Malcolm <dmalcolm (a] redhat.com> 2395 2396 PR analyzer/108455 2397 * analyzer.h (class checker_event): New forward decl. 2398 (class state_change_event): Indent. 2399 (class warning_event): New forward decl. 2400 * checker-event.cc (state_change_event::state_change_event): Add 2401 "enode" param. 2402 (warning_event::get_desc): Update for new param of 2403 evdesc::final_event ctor. 2404 * checker-event.h (state_change_event::state_change_event): Add 2405 "enode" param. 2406 (state_change_event::get_exploded_node): New accessor. 2407 (state_change_event::m_enode): New field. 2408 (warning_event::warning_event): New "enode" param. 2409 (warning_event::get_exploded_node): New accessor. 2410 (warning_event::m_enode): New field. 2411 * diagnostic-manager.cc 2412 (state_change_event_creator::on_global_state_change): Pass 2413 src_node to state_change_event ctor. 2414 (state_change_event_creator::on_state_change): Likewise. 2415 (null_assignment_sm_context::set_next_state): Pass NULL for 2416 new param of state_change_event ctor. 2417 * infinite-recursion.cc 2418 (infinite_recursion_diagnostic::add_final_event): Update for new 2419 param of warning_event ctor. 2420 * pending-diagnostic.cc (pending_diagnostic::add_final_event): 2421 Pass enode to warning_event ctor. 2422 * pending-diagnostic.h (evdesc::final_event): Add reference to 2423 warning_event. 2424 * sm-malloc.cc: Include "analyzer/checker-event.h" and 2425 "analyzer/exploded-graph.h". 2426 (deref_before_check::deref_before_check): Initialize new fields. 2427 (deref_before_check::emit): Reject warnings in which we were 2428 unable to determine the enodes of the dereference and the check. 2429 Reject warnings interprocedural warnings. Reject warnings in which 2430 the dereference doesn't dominate the check. 2431 (deref_before_check::describe_state_change): Set m_deref_enode. 2432 (deref_before_check::describe_final_event): Set m_check_enode. 2433 (deref_before_check::m_deref_enode): New field. 2434 (deref_before_check::m_check_enode): New field. 2435 2436 2023-01-13 David Malcolm <dmalcolm (a] redhat.com> 2437 2438 PR analyzer/105273 2439 * region-model.cc (has_nondefault_case_for_value_p): New. 2440 (has_nondefault_cases_for_all_enum_values_p): New. 2441 (region_model::apply_constraints_for_gswitch): Skip 2442 implicitly-created "default" when switching on an enum 2443 and all enum values have non-default cases. 2444 (rejected_default_case::dump_to_pp): New. 2445 * region-model.h (region_model_context::possibly_tainted_p): New 2446 decl. 2447 (class rejected_default_case): New. 2448 * sm-taint.cc (region_model_context::possibly_tainted_p): New. 2449 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump 2450 when implicitly_created_default_p. 2451 (switch_cfg_superedge::implicitly_created_default_p): New. 2452 * supergraph.h 2453 (switch_cfg_superedge::implicitly_created_default_p): New decl. 2454 2455 2023-01-11 David Malcolm <dmalcolm (a] redhat.com> 2456 2457 PR analyzer/108252 2458 * kf.cc (class kf_strdup): New. 2459 (class kf_strndup): New. 2460 (register_known_functions): Register them. 2461 * region-model.cc (region_model::on_call_pre): Use 2462 &HEAP_ALLOCATED_REGION for the default result of an external 2463 function with the "malloc" attribute, rather than CONJURED_SVALUE. 2464 (region_model::get_or_create_region_for_heap_alloc): Allow 2465 "size_in_bytes" to be NULL. 2466 * store.cc (store::set_value): When handling *UNKNOWN = VAL, 2467 mark VAL as "maybe bound". 2468 2469 2022-12-16 David Malcolm <dmalcolm (a] redhat.com> 2470 2471 PR analyzer/106479 2472 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region 2473 to region_model::check_for_poison. 2474 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL 2475 region to region_model::check_for_poison. 2476 * region-model.cc (region_model::check_for_poison): Add 2477 "src_region" param, and pass it to poisoned_value_diagnostic. 2478 (region_model::on_assignment): Pass NULL region to 2479 region_model::check_for_poison. 2480 (region_model::get_rvalue): Likewise. 2481 * region-model.h (region_model::check_for_poison): Add 2482 "src_region" param. 2483 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region 2484 to region_model::check_for_poison. 2485 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to 2486 region_model::check_for_poison. 2487 (kf_va_arg::impl_call_pre): Pass in source region to 2488 region_model::check_for_poison. 2489 2490 2022-12-14 David Malcolm <dmalcolm (a] redhat.com> 2491 2492 PR analyzer/108065 2493 * region.cc (decl_region::get_svalue_for_initializer): Bail out to 2494 avoid calling binding_key::make with an empty region. 2495 * store.cc (binding_map::apply_ctor_val_to_range): Likewise. 2496 (binding_map::apply_ctor_pair_to_child_region): Likewise. 2497 (binding_cluster::bind): Likewise. 2498 (binding_cluster::purge_region): Likewise. 2499 (binding_cluster::maybe_get_compound_binding): Likewise. 2500 (binding_cluster::maybe_get_simple_value): Likewise. 2501 2502 2022-12-09 David Malcolm <dmalcolm (a] redhat.com> 2503 2504 * analyzer.h (class known_function): Expand comment. 2505 * region-model-impl-calls.cc: Rename to... 2506 * kf.cc: ...this. 2507 * known-function-manager.h (class known_function_manager): Add 2508 leading comment. 2509 2510 2022-12-09 David Malcolm <dmalcolm (a] redhat.com> 2511 2512 PR analyzer/108003 2513 * call-summary.cc 2514 (call_summary_replay::convert_region_from_summary_1): Convert 2515 heap_regs_in_use from auto_sbitmap to auto_bitmap. 2516 * region-model-manager.cc 2517 (region_model_manager::get_or_create_region_for_heap_alloc): 2518 Convert from sbitmap to bitmap. 2519 * region-model-manager.h: Likewise. 2520 * region-model.cc 2521 (region_model::get_or_create_region_for_heap_alloc): Convert from 2522 auto_sbitmap to auto_bitmap. 2523 (region_model::get_referenced_base_regions): Likewise. 2524 * region-model.h: Include "bitmap.h" rather than "sbitmap.h". 2525 (region_model::get_referenced_base_regions): Convert from 2526 auto_sbitmap to auto_bitmap. 2527 2528 2022-12-09 David Malcolm <dmalcolm (a] redhat.com> 2529 2530 * region-model-impl-calls.cc (class kf_memcpy): Rename to... 2531 (class kf_memcpy_memmove): ...this. 2532 (kf_memcpy::impl_call_pre): Rename to... 2533 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for 2534 poison. 2535 (register_known_functions): Update for above renaming, and 2536 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK. 2537 2538 2022-12-06 David Malcolm <dmalcolm (a] redhat.com> 2539 2540 PR analyzer/107882 2541 * region-model.cc (region_model::get_store_value): Return an 2542 unknown value for empty regions. 2543 (region_model::set_value): Bail on empty regions. 2544 * region.cc (region::empty_p): New. 2545 * region.h (region::empty_p): New decl. 2546 * state-purge.cc (same_binding_p): Bail if either region is empty. 2547 * store.cc (binding_key::make): Assert that a concrete binding's 2548 bit_size must be > 0. 2549 (binding_cluster::mark_region_as_unknown): Bail on empty regions. 2550 (binding_cluster::get_binding): Likewise. 2551 (binding_cluster::remove_overlapping_bindings): Likewise. 2552 (binding_cluster::on_unknown_fncall): Don't conjure values for 2553 empty regions. 2554 (store::fill_region): Bail on empty regions. 2555 * store.h (class concrete_binding): Update comment to reflect that 2556 the range of bits must be non-empty. 2557 (concrete_binding::concrete_binding): Assert that bit range is 2558 non-empty. 2559 2560 2022-12-06 David Malcolm <dmalcolm (a] redhat.com> 2561 2562 PR analyzer/106325 2563 * region-model-manager.cc 2564 (region_model_manager::get_or_create_null_ptr): New. 2565 * region-model-manager.h 2566 (region_model_manager::get_or_create_null_ptr): New decl. 2567 * region-model.cc (region_model::on_top_level_param): Add 2568 "nonnull" param and make use of it. 2569 (region_model::push_frame): When handling a top-level entrypoint 2570 to the analysis, determine which params __attribute__((nonnull)) 2571 applies to, and pass to on_top_level_param. 2572 * region-model.h (region_model::on_top_level_param): Add "nonnull" 2573 param. 2574 2575 2022-12-06 David Malcolm <dmalcolm (a] redhat.com> 2576 2577 * analyzer.h (register_known_analyzer_functions): New decl. 2578 (register_known_functions_lang_cp): New decl. 2579 * call-details.cc: New file, split out from 2580 region-model-impl-calls.cc. 2581 * call-details.h: New file, split out from region-model.h. 2582 * call-info.cc: Include "analyzer/call-details.h". 2583 * call-summary.h: Likewise. 2584 * kf-analyzer.cc: New file, split out from 2585 region-model-impl-calls.cc. 2586 * kf-lang-cp.cc: Likewise. 2587 * known-function-manager.cc: Include "analyzer/call-details.h". 2588 * region-model-impl-calls.cc: Move definitions of call_details's 2589 member functions to call-details.cc. Move class kf_analyzer_* to 2590 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to 2591 kf-lang-cp.cc. Refresh #includes accordingly. 2592 (register_known_functions): Replace registration of __analyzer_* 2593 functions with a call to register_known_analyzer_functions. 2594 Replace registration of C++ support functions with a call to 2595 register_known_functions_lang_cp. 2596 * region-model.h (class call_details): Move to new call-details.h. 2597 * sm-fd.cc: Include "analyzer/call-details.h". 2598 * sm-file.cc: Likewise. 2599 * sm-malloc.cc: Likewise. 2600 * varargs.cc: Likewise. 2601 2602 2022-12-02 David Malcolm <dmalcolm (a] redhat.com> 2603 2604 * analyzer.h (struct event_loc_info): New forward decl. 2605 * bounds-checking.cc: Use event_loc_info throughout to bundle the 2606 loc, fndecl, depth triples. 2607 * call-info.cc: Likewise. 2608 * checker-event.cc: Likewise. 2609 * checker-event.h (struct event_loc_info): New decl. Use it 2610 throughout to bundle the loc, fndecl, depth triples. 2611 * checker-path.cc: Likewise. 2612 * checker-path.h: Likewise. 2613 * diagnostic-manager.cc: Likewise. 2614 * engine.cc: Likewise. 2615 * infinite-recursion.cc: Likewise. 2616 * pending-diagnostic.cc: Likewise. 2617 * pending-diagnostic.h: Likewise. 2618 * region-model.cc: Likewise. 2619 * sm-signal.cc: Likewise. 2620 * varargs.cc: Likewise. 2621 2622 2022-12-02 David Malcolm <dmalcolm (a] redhat.com> 2623 2624 PR analyzer/107851 2625 * analyzer.cc (make_label_text_n): Convert param "n" from int to 2626 unsigned HOST_WIDE_INT. 2627 * analyzer.h (make_label_text_n): Likewise for decl. 2628 * bounds-checking.cc: Include "analyzer/checker-event.h" and 2629 "analyzer/checker-path.h". 2630 (out_of_bounds::add_region_creation_events): New. 2631 (concrete_past_the_end::describe_region_creation_event): Replace 2632 with... 2633 (concrete_past_the_end::add_region_creation_events): ...this. 2634 (symbolic_past_the_end::describe_region_creation_event): Delete. 2635 * checker-event.cc (region_creation_event::region_creation_event): 2636 Update for dropping all member data. 2637 (region_creation_event::get_desc): Delete, splitting out into 2638 region_creation_event_memory_space::get_desc, 2639 region_creation_event_capacity::get_desc, and 2640 region_creation_event_debug::get_desc. 2641 (region_creation_event_memory_space::get_desc): New. 2642 (region_creation_event_capacity::get_desc): New. 2643 (region_creation_event_allocation_size::get_desc): New. 2644 (region_creation_event_debug::get_desc): New. 2645 * checker-event.h: Include "analyzer/program-state.h". 2646 (enum rce_kind): Delete. 2647 (class region_creation_event): Drop all member data. 2648 (region_creation_event::region_creation_event): Make protected. 2649 (region_creation_event::get_desc): Delete. 2650 (class region_creation_event_memory_space): New. 2651 (class region_creation_event_capacity): New. 2652 (class region_creation_event_allocation_size): New. 2653 (class region_creation_event_debug): New. 2654 * checker-path.cc (checker_path::add_region_creation_events): Add 2655 "pd" param. Call pending_diangnostic::add_region_creation_events. 2656 Update for conversion of RCE_DEBUG to region_creation_event_debug. 2657 * checker-path.h (checker_path::add_region_creation_events): Add 2658 "pd" param. 2659 * diagnostic-manager.cc (diagnostic_manager::build_emission_path): 2660 Pass pending_diagnostic to 2661 emission_path::add_region_creation_events. 2662 (diagnostic_manager::build_emission_path): Pass path_builder to 2663 add_event_on_final_node. 2664 (diagnostic_manager::add_event_on_final_node): Add "pb" param. 2665 Pass pending_diagnostic to 2666 emission_path::add_region_creation_events. 2667 (diagnostic_manager::add_events_for_eedge): Pass 2668 pending_diagnostic to emission_path::add_region_creation_events. 2669 * diagnostic-manager.h 2670 (diagnostic_manager::add_event_on_final_node): Add "pb" param. 2671 * pending-diagnostic.cc 2672 (pending_diagnostic::add_region_creation_events): New. 2673 * pending-diagnostic.h (struct region_creation): Delete. 2674 (pending_diagnostic::describe_region_creation_event): Delete. 2675 (pending_diagnostic::add_region_creation_events): New vfunc. 2676 * region-model.cc: Include "analyzer/checker-event.h" and 2677 "analyzer/checker-path.h". 2678 (dubious_allocation_size::dubious_allocation_size): Initialize 2679 m_has_allocation_event. 2680 (dubious_allocation_size::describe_region_creation_event): Delete. 2681 (dubious_allocation_size::describe_final_event): Update for 2682 replacement of m_allocation_event with m_has_allocation_event. 2683 (dubious_allocation_size::add_region_creation_events): New. 2684 (dubious_allocation_size::m_allocation_event): Replace with... 2685 (dubious_allocation_size::m_has_allocation_event): ...this. 2686 2687 2022-12-02 David Malcolm <dmalcolm (a] redhat.com> 2688 2689 PR analyzer/107948 2690 * region-model-manager.cc 2691 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL. 2692 * region-model.cc (region_model::eval_condition): Handle e.g. 2693 "-X <= 0" as equivalent to X >= 0". 2694 2695 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2696 2697 PR analyzer/106626 2698 * bounds-checking.cc 2699 (symbolic_past_the_end::describe_final_event): Delete, moving to 2700 symbolic_buffer_overflow::describe_final_event and 2701 symbolic_buffer_over_read::describe_final_event, eliminating 2702 composition of text strings via "byte_str" and "m_dir_str". 2703 (symbolic_past_the_end::m_dir_str): Delete field. 2704 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop 2705 m_dir_str. 2706 (symbolic_buffer_overflow::describe_final_event): New, as noted 2707 above. 2708 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop 2709 m_dir_str. 2710 (symbolic_buffer_over_read::describe_final_event): New, as noted 2711 above. 2712 2713 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2714 2715 * bounds-checking.cc (class out_of_bounds): Split out from... 2716 (class concrete_out_of_bounds): New abstract subclass. 2717 (class past_the_end): Rename to... 2718 (class concrete_past_the_end): ...this, and make a subclass of 2719 concrete_out_of_bounds. 2720 (class buffer_overflow): Rename to... 2721 (class concrete_buffer_overflow): ...this, and make a subclass of 2722 concrete_past_the_end. 2723 (class buffer_over_read): Rename to... 2724 (class concrete_buffer_over_read): ...this, and make a subclass of 2725 concrete_past_the_end. 2726 (class buffer_underwrite): Rename to... 2727 (class concrete_buffer_underwrite): ...this, and make a subclass 2728 of concrete_out_of_bounds. 2729 (class buffer_under_read): Rename to... 2730 (class concrete_buffer_under_read): ...this, and make a subclass 2731 of concrete_out_of_bounds. 2732 (class symbolic_past_the_end): Convert to a subclass of 2733 out_of_bounds. 2734 (symbolic_buffer_overflow::get_kind): New. 2735 (symbolic_buffer_over_read::get_kind): New. 2736 (region_model::check_region_bounds): Update for renamings. 2737 * engine.cc (impl_sm_context::set_next_state): Eliminate 2738 "new_ctxt", passing NULL to get_rvalue instead. 2739 (impl_sm_context::warn): Likewise. 2740 2741 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2742 2743 PR analyzer/106626 2744 * bounds-checking.cc (out_of_bounds::get_memory_space): New. 2745 (buffer_overflow::emit): Use it. 2746 (class buffer_overread): Rename to... 2747 (class buffer_over_read): ...this. 2748 (buffer_over_read::emit): Specify which memory space the read is 2749 from, where known. Change "overread" to "over-read". 2750 (class buffer_underflow): Rename to... 2751 (class buffer_underwrite): ...this. 2752 (buffer_underwrite::emit): Specify which memory space the write is 2753 to, where known. Change "underflow" to "underwrite". 2754 (class buffer_underread): Rename to... 2755 (class buffer_under_read): Rename to... 2756 (buffer_under_read::emit): Specify which memory space the read is 2757 from, where known. Change "underread" to "under-read". 2758 (symbolic_past_the_end::get_memory_space): New. 2759 (symbolic_buffer_overflow::emit): Use it. 2760 (class symbolic_buffer_overread): Rename to... 2761 (class symbolic_buffer_over_read): ...this. 2762 (symbolic_buffer_over_read::emit): Specify which memory space the 2763 read is from, where known. Change "overread" to "over-read". 2764 (region_model::check_symbolic_bounds): Update for class renaming. 2765 (region_model::check_region_bounds): Likewise. 2766 2767 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2768 2769 PR analyzer/106626 2770 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds): 2771 New. 2772 (buffer_overflow::emit): Call maybe_describe_array_bounds. 2773 (buffer_overread::emit): Likewise. 2774 (buffer_underflow::emit): Likewise. 2775 (buffer_underread::emit): Likewise. 2776 2777 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2778 2779 PR analyzer/106626 2780 * bounds-checking.cc (buffer_overflow::emit): Use inform_n. 2781 Update wording to clarify that we're talking about the size of 2782 the bad access, rather than its position. 2783 (buffer_overread::emit): Likewise. 2784 2785 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2786 2787 * bounds-checking.cc: New file, taken from region-model.cc. 2788 * region-model.cc (class out_of_bounds): Move to 2789 bounds-checking.cc. 2790 (class past_the_end): Likewise. 2791 (class buffer_overflow): Likewise. 2792 (class buffer_overread): Likewise. 2793 (class buffer_underflow): Likewise. 2794 (class buffer_underread): Likewise. 2795 (class symbolic_past_the_end): Likewise. 2796 (class symbolic_buffer_overflow): Likewise. 2797 (class symbolic_buffer_overread): Likewise. 2798 (region_model::check_symbolic_bounds): Likewise. 2799 (maybe_get_integer_cst_tree): Likewise. 2800 (region_model::check_region_bounds): Likewise. 2801 * region-model.h: Add comment. 2802 2803 2022-12-01 David Malcolm <dmalcolm (a] redhat.com> 2804 2805 PR analyzer/107928 2806 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in 2807 the "success" outcome. 2808 (fd_state_machine::on_connect): Likewise. 2809 * sm-fd.dot: Add "constant_fd" state and its transitions. 2810 2811 2022-11-30 David Malcolm <dmalcolm (a] redhat.com> 2812 2813 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc. 2814 (kf_fgets::impl_call_pre): Likewise. 2815 (class kf_fread): Likewise. 2816 (kf_fread::impl_call_pre): Likewise. 2817 (class kf_getchar): Likewise. 2818 (class kf_stdio_output_fn): Likewise. 2819 (register_known_functions): Move registration of 2820 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC, 2821 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED, 2822 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF, 2823 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR, 2824 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS, 2825 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, 2826 "getchar", "fgets", "fgets_unlocked", and "fread" to 2827 register_known_file_functions. 2828 * sm-file.cc (class kf_stdio_output_fn): Move here from 2829 region-model-impl-calls.cc. 2830 (class kf_fgets): Likewise. 2831 (class kf_fread): Likewise. 2832 (class kf_getchar): Likewise. 2833 (register_known_file_functions): Move registration of 2834 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC, 2835 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED, 2836 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF, 2837 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR, 2838 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS, 2839 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, 2840 "fgets", "fgets_unlocked", "fread", and "getchar" to here from 2841 register_known_functions. 2842 2843 2022-11-30 David Malcolm <dmalcolm (a] redhat.com> 2844 2845 PR analyzer/103546 2846 * analyzer.h (register_known_file_functions): New decl. 2847 * program-state.cc (sm_state_map::replay_call_summary): Rejct 2848 attempts to store sm-state for caller_sval that can't have 2849 associated state. 2850 * region-model-impl-calls.cc (register_known_functions): Call 2851 register_known_file_functions. 2852 * sm-fd.cc (class kf_isatty): New. 2853 (register_known_fd_functions): Register it. 2854 * sm-file.cc (class kf_ferror): New. 2855 (class kf_fileno): New. 2856 (class kf_getc): New. 2857 (register_known_file_functions): New. 2858 2859 2022-11-30 David Malcolm <dmalcolm (a] redhat.com> 2860 2861 PR analyzer/105784 2862 * region-model-manager.cc 2863 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR, 2864 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final 2865 type matches that of arg0 in favor of a cast. 2866 2867 2022-11-24 Martin Liska <mliska (a] suse.cz> 2868 2869 * varargs.cc: Fix Clang warnings. 2870 2871 2022-11-24 David Malcolm <dmalcolm (a] redhat.com> 2872 2873 PR analyzer/106473 2874 * call-summary.cc 2875 (call_summary_replay::convert_region_from_summary_1): Update for 2876 change to creation of heap-allocated regions. 2877 * program-state.cc (test_program_state_1): Likewise. 2878 (test_program_state_merging): Likewise. 2879 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise. 2880 (kf_malloc::impl_call_pre): Likewise. 2881 (kf_operator_new::impl_call_pre): Likewise. 2882 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise. 2883 * region-model-manager.cc 2884 (region_model_manager::create_region_for_heap_alloc): Convert 2885 to... 2886 (region_model_manager::get_or_create_region_for_heap_alloc): 2887 ...this, reusing an existing region if it's unreferenced in the 2888 client state. 2889 * region-model-manager.h (region_model_manager::get_num_regions): New. 2890 (region_model_manager::create_region_for_heap_alloc): Convert to... 2891 (region_model_manager::get_or_create_region_for_heap_alloc): ...this. 2892 * region-model.cc (region_to_value_map::can_merge_with_p): Reject 2893 merger when the values are different. 2894 (region_model::create_region_for_heap_alloc): Convert to... 2895 (region_model::get_or_create_region_for_heap_alloc): ...this. 2896 (region_model::get_referenced_base_regions): New. 2897 (selftest::test_state_merging): Update for change to creation of 2898 heap-allocated regions. 2899 (selftest::test_malloc_constraints): Likewise. 2900 (selftest::test_malloc): Likewise. 2901 * region-model.h: Include "sbitmap.h". 2902 (region_model::create_region_for_heap_alloc): Convert to... 2903 (region_model::get_or_create_region_for_heap_alloc): ...this. 2904 (region_model::get_referenced_base_regions): New decl. 2905 * store.cc (store::canonicalize): Don't purge a heap-allocated region 2906 that's been marked as escaping. 2907 2908 2022-11-24 David Malcolm <dmalcolm (a] redhat.com> 2909 2910 * checker-path.cc (checker_path::inject_any_inlined_call_events): 2911 Don't dump the address of the block when -fdump-noaddr. 2912 2913 2022-11-24 David Malcolm <dmalcolm (a] redhat.com> 2914 2915 * region-model.h (region_model::on_socket): Delete decl. 2916 (region_model::on_bind): Likewise. 2917 (region_model::on_listen): Likewise. 2918 (region_model::on_accept): Likewise. 2919 (region_model::on_connect): Likewise. 2920 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body 2921 of region_model::on_socket into here, ... 2922 (region_model::on_socket): ...eliminating this function. 2923 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind... 2924 (region_model::on_bind): ...eliminating this function. 2925 (kf_listen::outcome_of_listen::update_model): Likewise fo 2926 on_listen... 2927 (region_model::on_listen): ...eliminating this function. 2928 (kf_accept::outcome_of_accept::update_model): Likewise fo 2929 on_accept... 2930 (region_model::on_accept): ...eliminating this function. 2931 (kf_connect::outcome_of_connect::update_model): Likewise fo 2932 on_connect... 2933 (region_model::on_connect): ...eliminating this function. 2934 2935 2022-11-24 David Malcolm <dmalcolm (a] redhat.com> 2936 2937 * analyzer.h (register_known_fd_functions): New decl. 2938 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc. 2939 (class kf_bind): Likewise. 2940 (class kf_connect): Likewise. 2941 (class kf_listen): Likewise. 2942 (class kf_pipe): Likewise. 2943 (class kf_socket): Likewise. 2944 (register_known_functions): Remove registration of the above 2945 functions, instead calling register_known_fd_functions. 2946 * sm-fd.cc: Include "analyzer/call-info.h". 2947 (class kf_socket): Move here from region-model-impl-calls.cc. 2948 (class kf_bind): Likewise. 2949 (class kf_listen): Likewise. 2950 (class kf_accept): Likewise. 2951 (class kf_connect): Likewise. 2952 (class kf_pipe): Likewise. 2953 (register_known_fd_functions): New. 2954 2955 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 2956 2957 PR analyzer/107788 2958 * known-function-manager.cc (known_function_manager::get_match): 2959 Don't look up fndecls by name when they're not in the root 2960 namespace. 2961 2962 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 2963 2964 PR analyzer/107783 2965 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't 2966 complain when old state is "fd-constant". 2967 (fd_state_machine::on_listen): Likewise. 2968 (fd_state_machine::on_accept): Likewise. 2969 2970 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 2971 2972 PR analyzer/107807 2973 * region-model-impl-calls.cc (register_known_functions): Register 2974 "___errno" and "__error" as synonyms for "__errno_location". 2975 2976 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 2977 2978 * analyzer.h (class internal_known_function): New. 2979 (register_varargs_builtins): New decl. 2980 * engine.cc (exploded_node::on_stmt_pre): Remove 2981 "out_terminate_path" param from call to region_model::on_stmt_pre. 2982 (feasibility_state::maybe_update_for_edge): Likewise. 2983 * known-function-manager.cc: Include "basic-block.h", "gimple.h", 2984 and "analyzer/region-model.h". 2985 (known_function_manager::known_function_manager): Initialize 2986 m_combined_fns_arr. 2987 (known_function_manager::~known_function_manager): Clean up 2988 m_combined_fns_arr. 2989 (known_function_manager::get_by_identifier): Make const. 2990 (known_function_manager::add): New overloaded definitions for 2991 enum built_in_function and enum internal_fn. 2992 (known_function_manager::get_by_fndecl): Delete. 2993 (known_function_manager::get_match): New. 2994 (known_function_manager::get_internal_fn): New. 2995 (known_function_manager::get_normal_builtin): New. 2996 * known-function-manager.h 2997 (known_function_manager::get_by_identifier): Make private and 2998 add const qualifier. 2999 (known_function_manager::get_by_fndecl): Delete. 3000 (known_function_manager::add): Add overloaded decls for 3001 enum built_in_function name and enum internal_fn. 3002 (known_function_manager::get_match): New decl. 3003 (known_function_manager::get_internal_fn): New decl. 3004 (known_function_manager::get_normal_builtin): New decl. 3005 (known_function_manager::m_combined_fns_arr): New field. 3006 * region-model-impl-calls.cc (call_details::arg_is_size_p): New. 3007 (class kf_alloca): New. 3008 (region_model::impl_call_alloca): Convert to... 3009 (kf_alloca::impl_call_pre): ...this. 3010 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check 3011 to use call_details::arg_is_pointer_p. 3012 (region_model::impl_call_builtin_expect): Convert to... 3013 (class kf_expect): ...this. 3014 (class kf_calloc): New, adding check that both arguments are 3015 size_t. 3016 (region_model::impl_call_calloc): Convert to... 3017 (kf_calloc::impl_call_pre): ...this. 3018 (kf_connect::matches_call_types_p): Rewrite check to use 3019 call_details::arg_is_pointer_p. 3020 (region_model::impl_call_error): Convert to... 3021 (class kf_error): ...this, and... 3022 (kf_error::impl_call_pre): ...this. 3023 (class kf_fgets): New, adding checks that args 0 and 2 are 3024 pointers. 3025 (region_model::impl_call_fgets): Convert to... 3026 (kf_fgets::impl_call_pre): ...this. 3027 (class kf_fread): New, adding checks on the argument types. 3028 (region_model::impl_call_fread): Convert to... 3029 (kf_fread::impl_call_pre): ...this. 3030 (class kf_free): New, adding check that the argument is a pointer. 3031 (region_model::impl_call_free): Convert to... 3032 (kf_free::impl_call_post): ...this. 3033 (class kf_getchar): New. 3034 (class kf_malloc): New, adding check that the argument is a 3035 size_t. 3036 (region_model::impl_call_malloc): Convert to... 3037 (kf_malloc::impl_call_pre): ...this. 3038 (class kf_memcpy): New, adding checks on arguments. 3039 (region_model::impl_call_memcpy): Convert to... 3040 (kf_memcpy::impl_call_pre): ...this. 3041 (class kf_memset): New. 3042 (region_model::impl_call_memset): Convert to... 3043 (kf_memset::impl_call_pre): ...this. 3044 (kf_pipe::matches_call_types_p): Rewrite check to use 3045 call_details::arg_is_pointer_p. 3046 (kf_putenv::matches_call_types_p): Likewise. 3047 (class kf_realloc): New, adding checks on the argument types. 3048 (region_model::impl_call_realloc): Convert to... 3049 (kf_realloc::impl_call_post): ...this. 3050 (class kf_strchr): New. 3051 (region_model::impl_call_strchr): Convert to... 3052 (kf_strchr::impl_call_post): ...this. 3053 (class kf_stack_restore): New. 3054 (class kf_stack_save): New. 3055 (class kf_stdio_output_fn): New. 3056 (class kf_strcpy): New, 3057 (region_model::impl_call_strcpy): Convert to... 3058 (kf_strcpy::impl_call_pre): ...this. 3059 (class kf_strlen): New. 3060 (region_model::impl_call_strlen): Convert to... 3061 (kf_strlen::impl_call_pre): ...this. 3062 (class kf_ubsan_bounds): New. 3063 (region_model::impl_deallocation_call): Reimplement to avoid call 3064 to impl_call_free. 3065 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT 3066 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA, 3067 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT, 3068 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF, 3069 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC, 3070 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED, 3071 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, 3072 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, 3073 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF, 3074 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR, 3075 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS, 3076 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE, 3077 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY, 3078 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and 3079 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers 3080 for "getchar", "memset", "fgets", "fgets_unlocked", "fread", 3081 "error", and "error_at_line". 3082 * region-model.cc (region_model::on_stmt_pre): Drop 3083 "out_terminate_path" param. 3084 (region_model::get_known_function): Reimplement by calling 3085 known_function_manager::get_match, passing new "cd" param. 3086 Add overload taking enum internal_fn. 3087 (region_model::on_call_pre): Drop "out_terminate_path" param. 3088 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT, 3089 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA, 3090 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT, 3091 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC, 3092 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET, 3093 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR, 3094 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, 3095 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF, 3096 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, 3097 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, 3098 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE, 3099 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF, 3100 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR, 3101 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED, 3102 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and 3103 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc", 3104 "alloca", "realloc", "error", "error_at_line", "fgets", 3105 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and 3106 "strlen". Replace all this special-casing with calls to 3107 get_known_function for internal fns and for fn decls. 3108 (region_model::on_call_post): Remove special-casing handling for 3109 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR, 3110 and BUILT_IN_VA_END. Replace by consolidating on usage of 3111 get_known_function. 3112 * region-model.h (call_details::arg_is_size_p): New. 3113 (region_model::on_stmt_pre): Drop "out_terminate_path" param. 3114 (region_model::on_call_pre): Likewise. 3115 (region_model::impl_call_alloca): Delete. 3116 (region_model::impl_call_builtin_expect): Delete. 3117 (region_model::impl_call_calloc): Delete. 3118 (region_model::impl_call_error): Delete. 3119 (region_model::impl_call_fgets): Delete. 3120 (region_model::impl_call_fread): Delete. 3121 (region_model::impl_call_free): Delete. 3122 (region_model::impl_call_malloc): Delete. 3123 (region_model::impl_call_memcpy): Delete. 3124 (region_model::impl_call_memset): Delete. 3125 (region_model::impl_call_realloc): Delete. 3126 (region_model::impl_call_strchr): Delete. 3127 (region_model::impl_call_strcpy): Delete. 3128 (region_model::impl_call_strlen): Delete. 3129 (region_model::impl_call_va_start): Delete. 3130 (region_model::impl_call_va_copy): Delete. 3131 (region_model::impl_call_va_arg): Delete. 3132 (region_model::impl_call_va_end): Delete. 3133 (region_model::check_region_for_write): Public. 3134 (region_model::get_known_function): Add "cd" param. Add 3135 overloaded decl taking enum internal_fn. 3136 * sm-malloc.cc: Update comments. 3137 * varargs.cc (class kf_va_start): New. 3138 (region_model::impl_call_va_start): Convert to... 3139 (kf_va_start::impl_call_pre): ...this. 3140 (class kf_va_copy): New. 3141 (region_model::impl_call_va_copy): Convert to... 3142 (kf_va_copy::impl_call_pre): ...this. 3143 (class kf_va_arg): New. 3144 (region_model::impl_call_va_arg): Convert to... 3145 (kf_va_arg::impl_call_pre): ...this. 3146 (class kf_va_end): New. 3147 (region_model::impl_call_va_end): Delete. 3148 (register_varargs_builtins): New. 3149 3150 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 3151 3152 PR analyzer/107788 3153 * region-model.cc (region_model::update_for_int_cst_return): 3154 Require that the return type be an integer type. 3155 (region_model::update_for_nonzero_return): Likewise. 3156 3157 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 3158 3159 PR analyzer/107783 3160 * region-model-impl-calls.cc (kf_accept::matches_call_types_p): 3161 Require that args 1 and 2 be pointers. 3162 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer. 3163 * region-model.h (call_details::arg_is_pointer_p): New 3164 3165 2022-11-22 David Malcolm <dmalcolm (a] redhat.com> 3166 3167 PR analyzer/107777 3168 * call-summary.cc 3169 (call_summary_replay::convert_region_from_summary_1): Handle 3170 RK_THREAD_LOCAL and RK_ERRNO in switch. 3171 * region-model.cc (region_model::get_representative_path_var_1): 3172 Likewise. 3173 3174 2022-11-19 David Malcolm <dmalcolm (a] redhat.com> 3175 3176 PR analyzer/107582 3177 * engine.cc (dynamic_call_info_t::update_model): Update the model 3178 by pushing or pop a frame, rather than by clobbering it with the 3179 model from the exploded_node's state. 3180 3181 2022-11-18 David Malcolm <dmalcolm (a] redhat.com> 3182 3183 * analyzer.cc (is_pipe_call_p): Delete. 3184 * analyzer.h (is_pipe_call_p): Delete. 3185 * region-model-impl-calls.cc (call_details::get_location): New. 3186 (class kf_analyzer_break): New, adapted from 3187 region_model::on_stmt_pre. 3188 (region_model::impl_call_analyzer_describe): Convert to... 3189 (class kf_analyzer_describe): ...this. 3190 (region_model::impl_call_analyzer_dump_capacity): Convert to... 3191 (class kf_analyzer_dump_capacity): ...this. 3192 (region_model::impl_call_analyzer_dump_escaped): Convert to... 3193 (class kf_analyzer_dump_escaped): ...this. 3194 (class kf_analyzer_dump_exploded_nodes): New. 3195 (region_model::impl_call_analyzer_dump_named_constant): Convert 3196 to... 3197 (class kf_analyzer_dump_named_constant): ...this. 3198 (class dump_path_diagnostic): Move here from region-model.cc. 3199 (class kf_analyzer_dump_path) New, adapted from 3200 region_model::on_stmt_pre. 3201 (class kf_analyzer_dump_region_model): Likewise. 3202 (region_model::impl_call_analyzer_eval): Convert to... 3203 (class kf_analyzer_eval): ...this. 3204 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to... 3205 (class kf_analyzer_get_unknown_ptr): ...this. 3206 (class known_function_accept): Rename to... 3207 (class kf_accept): ...this. 3208 (class known_function_bind): Rename to... 3209 (class kf_bind): ...this. 3210 (class known_function_connect): Rename to... 3211 (class kf_connect): ...this. 3212 (region_model::impl_call_errno_location): Convert to... 3213 (class kf_errno_location): ...this. 3214 (class known_function_listen): Rename to... 3215 (class kf_listen): ...this. 3216 (region_model::impl_call_pipe): Convert to... 3217 (class kf_pipe): ...this. 3218 (region_model::impl_call_putenv): Convert to... 3219 (class kf_putenv): ...this. 3220 (region_model::impl_call_operator_new): Convert to... 3221 (class kf_operator_new): ...this. 3222 (region_model::impl_call_operator_delete): Convert to... 3223 (class kf_operator_delete): ...this. 3224 (class known_function_socket): Rename to... 3225 (class kf_socket): ...this. 3226 (register_known_functions): Rename param to KFM. Break out 3227 existing known functions into a "POSIX" section, and add "pipe", 3228 "pipe2", and "putenv". Add debugging functions 3229 "__analyzer_break", "__analyzer_describe", 3230 "__analyzer_dump_capacity", "__analyzer_dump_escaped", 3231 "__analyzer_dump_exploded_nodes", 3232 "__analyzer_dump_named_constant", "__analyzer_dump_path", 3233 "__analyzer_dump_region_model", "__analyzer_eval", 3234 "__analyzer_get_unknown_ptr". Add C++ support functions 3235 "operator new", "operator new []", "operator delete", and 3236 "operator delete []". 3237 * region-model.cc (class dump_path_diagnostic): Move to 3238 region-model-impl-calls.cc. 3239 (region_model::on_stmt_pre): Eliminate special-casing of 3240 "__analyzer_describe", "__analyzer_dump_capacity", 3241 "__analyzer_dump_escaped", "__analyzer_dump_named_constant", 3242 "__analyzer_dump_path", "__analyzer_dump_region_model", 3243 "__analyzer_eval", "__analyzer_break", 3244 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr", 3245 "__errno_location", "pipe", "pipe2", "putenv", "operator new", 3246 "operator new []", "operator delete", "operator delete []" 3247 "pipe" and "pipe2", handling them instead via the known_functions 3248 mechanism. 3249 * region-model.h (call_details::get_location): New decl. 3250 (region_model::impl_call_analyzer_describe): Delete decl. 3251 (region_model::impl_call_analyzer_dump_capacity): Delete decl. 3252 (region_model::impl_call_analyzer_dump_escaped): Delete decl. 3253 (region_model::impl_call_analyzer_dump_named_constant): Delete decl. 3254 (region_model::impl_call_analyzer_eval): Delete decl. 3255 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl. 3256 (region_model::impl_call_errno_location): Delete decl. 3257 (region_model::impl_call_pipe): Delete decl. 3258 (region_model::impl_call_putenv): Delete decl. 3259 (region_model::impl_call_operator_new): Delete decl. 3260 (region_model::impl_call_operator_delete): Delete decl. 3261 * sm-fd.cc: Update comments. 3262 3263 2022-11-16 David Malcolm <dmalcolm (a] redhat.com> 3264 3265 PR analyzer/107711 3266 * analyzer-language.cc: Include "diagnostic.h". 3267 (maybe_stash_named_constant): Add logger param and use it to log 3268 the name being looked up, and the result. 3269 (stash_named_constants): New, splitting out from... 3270 (on_finish_translation_unit): ...this function. Call 3271 get_or_create_logfile and use the result to create a logger 3272 instance, passing it to stash_named_constants. 3273 * analyzer.h (get_or_create_any_logfile): New decl. 3274 * engine.cc (dump_fout, owns_dump_fout): New globals, split out 3275 from run_checkers. 3276 (get_or_create_any_logfile): New function, split out from... 3277 (run_checkers): ...here, so that the logfile can be opened by 3278 on_finish_translation_unit. Clear the globals when closing the 3279 dump file. 3280 3281 2022-11-16 David Malcolm <dmalcolm (a] redhat.com> 3282 3283 * analyzer.h (known_function::matches_call_types_p): New vfunc. 3284 (known_function::impl_call_pre): Provide base implementation. 3285 (known_function::impl_call_post): New vfunc. 3286 (register_known_functions): New. 3287 * engine.cc (impl_run_checkers): Call register_known_functions. 3288 * region-model-impl-calls.cc (region_model::impl_call_accept): 3289 Convert to... 3290 (class known_function_accept): ...this. 3291 (region_model::impl_call_bind): Convert to... 3292 (class known_function_bind): ...this. 3293 (region_model::impl_call_connect): Convert to... 3294 (class known_function_connect): ...this. 3295 (region_model::impl_call_listen): Convert to... 3296 (class known_function_listen): ...this. 3297 (region_model::impl_call_socket): Convert to... 3298 (class known_function_socket): ...this. 3299 (register_known_functions): New. 3300 * region-model.cc (region_model::on_call_pre): Remove special 3301 case for "bind" in favor of the known_function-handling dispatch. 3302 Add call to known_function::matches_call_types_p to latter. 3303 (region_model::on_call_post): Remove special cases for "accept", 3304 "bind", "connect", "listen", and "socket" in favor of dispatch 3305 to known_function::impl_call_post. 3306 * region-model.h (region_model::impl_call_accept): Delete decl. 3307 (region_model::impl_call_bind): Delete decl. 3308 (region_model::impl_call_connect): Delete decl. 3309 (region_model::impl_call_listen): Delete decl. 3310 (region_model::impl_call_socket): Delete decl. 3311 * sm-fd.cc: Update comments. 3312 3313 2022-11-16 David Malcolm <dmalcolm (a] redhat.com> 3314 3315 * checker-event.cc: New file, split out from... 3316 * checker-path.cc: ...this file. 3317 3318 2022-11-15 David Malcolm <dmalcolm (a] redhat.com> 3319 3320 PR analyzer/106140 3321 * analyzer-language.cc (on_finish_translation_unit): Stash named 3322 constants "SOCK_STREAM" and "SOCK_DGRAM". 3323 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New. 3324 (Wanalyzer-fd-type-mismatch): New. 3325 * engine.cc (impl_region_model_context::get_state_map_by_name): 3326 Add "out_sm_context" param. Allow out_sm_idx to be NULL. 3327 * exploded-graph.h 3328 (impl_region_model_context::get_state_map_by_name): 3329 Add "out_sm_context" param. 3330 * region-model-impl-calls.cc (region_model::impl_call_accept): New. 3331 (region_model::impl_call_bind): New. 3332 (region_model::impl_call_connect): New. 3333 (region_model::impl_call_listen): New. 3334 (region_model::impl_call_socket): New. 3335 * region-model.cc (region_model::on_call_pre): Special-case 3336 "bind". 3337 (region_model::on_call_post): Special-case "accept", "bind", 3338 "connect", "listen", and "socket". 3339 * region-model.h (region_model::impl_call_accept): New decl. 3340 (region_model::impl_call_bind): New decl. 3341 (region_model::impl_call_connect): New decl. 3342 (region_model::impl_call_listen): New decl. 3343 (region_model::impl_call_socket): New decl. 3344 (region_model::on_socket): New decl. 3345 (region_model::on_bind): New decl. 3346 (region_model::on_listen): New decl. 3347 (region_model::on_accept): New decl. 3348 (region_model::on_connect): New decl. 3349 (region_model::add_constraint): Make public. 3350 (region_model::check_for_poison): Make public. 3351 (region_model_context::get_state_map_by_name): Add out_sm_context param. 3352 (region_model_context::get_fd_map): Likewise. 3353 (region_model_context::get_malloc_map): Likewise. 3354 (region_model_context::get_taint_map): Likewise. 3355 (noop_region_model_context::get_state_map_by_name): Likewise. 3356 (region_model_context_decorator::get_state_map_by_name): Likewise. 3357 * sm-fd.cc: Include "analyzer/supergraph.h" and 3358 "analyzer/analyzer-language.h". 3359 (enum expected_phase): New enum. 3360 (fd_state_machine::m_new_datagram_socket): New. 3361 (fd_state_machine::m_new_stream_socket): New. 3362 (fd_state_machine::m_new_unknown_socket): New. 3363 (fd_state_machine::m_bound_datagram_socket): New. 3364 (fd_state_machine::m_bound_stream_socket): New. 3365 (fd_state_machine::m_bound_unknown_socket): New. 3366 (fd_state_machine::m_listening_stream_socket): New. 3367 (fd_state_machine::m_m_connected_stream_socket): New. 3368 (fd_state_machine::m_SOCK_STREAM): New. 3369 (fd_state_machine::m_SOCK_DGRAM): New. 3370 (fd_diagnostic::describe_state_change): Handle socket states. 3371 (fd_diagnostic::get_meaning_for_state_change): Likewise. 3372 (class fd_phase_mismatch): New. 3373 (enum expected_type): New enum. 3374 (class fd_type_mismatch): New. 3375 (fd_state_machine::fd_state_machine): Initialize new states and 3376 stashed named constants. 3377 (fd_state_machine::is_socket_fd_p): New. 3378 (fd_state_machine::is_datagram_socket_fd_p): New. 3379 (fd_state_machine::is_stream_socket_fd_p): New. 3380 (fd_state_machine::on_close): Handle the socket states. 3381 (fd_state_machine::check_for_open_fd): Complain about fncalls on 3382 sockets in the wrong phase. Support socket FDs. 3383 (add_constraint_ge_zero): New. 3384 (fd_state_machine::get_state_for_socket_type): New. 3385 (fd_state_machine::on_socket): New. 3386 (fd_state_machine::check_for_socket_fd): New. 3387 (fd_state_machine::check_for_new_socket_fd): New. 3388 (fd_state_machine::on_bind): New. 3389 (fd_state_machine::on_listen): New. 3390 (fd_state_machine::on_accept): New. 3391 (fd_state_machine::on_connect): New. 3392 (fd_state_machine::can_purge_p): Don't purge socket values. 3393 (get_fd_state): New. 3394 (region_model::mark_as_valid_fd): Use get_fd_state. 3395 (region_model::on_socket): New. 3396 (region_model::on_bind): New. 3397 (region_model::on_listen): New. 3398 (region_model::on_accept): New. 3399 (region_model::on_connect): New. 3400 * sm-fd.dot: Update to reflect sm-fd.cc changes. 3401 3402 2022-11-15 David Malcolm <dmalcolm (a] redhat.com> 3403 3404 PR analyzer/106302 3405 * analyzer-language.cc: New file. 3406 * analyzer-language.h: New file. 3407 * analyzer.h (get_stashed_constant_by_name): New decl. 3408 (log_stashed_constants): New decl. 3409 * engine.cc (impl_run_checkers): Call log_stashed_constants. 3410 * region-model-impl-calls.cc 3411 (region_model::impl_call_analyzer_dump_named_constant): New. 3412 * region-model.cc (region_model::on_stmt_pre): Handle 3413 __analyzer_dump_named_constant. 3414 * region-model.h 3415 (region_model::impl_call_analyzer_dump_named_constant): New decl. 3416 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New. 3417 (fd_state_machine::m_O_RDONLY): New. 3418 (fd_state_machine::m_O_WRONLY): New. 3419 (fd_state_machine::fd_state_machine): Initialize the new fields. 3420 (fd_state_machine::get_access_mode_from_flag): Use the new fields, 3421 rather than using the host values. 3422 3423 2022-11-13 David Malcolm <dmalcolm (a] redhat.com> 3424 3425 PR analyzer/106235 3426 * analyzer.opt (Wanalyzer-tainted-assertion): New. 3427 * checker-path.cc (checker_path::fixup_locations): Pass false to 3428 pending_diagnostic::fixup_location. 3429 * diagnostic-manager.cc (get_emission_location): Pass true to 3430 pending_diagnostic::fixup_location. 3431 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add 3432 bool param. 3433 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add 3434 bool param to decl. 3435 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New. 3436 (taint_diagnostic::describe_state_change): Drop "final". 3437 (class tainted_assertion): New. 3438 (taint_state_machine::taint_state_machine): Initialize 3439 m_tainted_control_flow. 3440 (taint_state_machine::alt_get_inherited_state): Support 3441 comparisons being tainted, based on their arguments. 3442 (is_assertion_failure_handler_p): New. 3443 (taint_state_machine::on_stmt): Complain about calls to assertion 3444 failure handlers guarded by an attacker-controller conditional. 3445 Detect attacker-controlled gcond conditionals and gswitch index 3446 values. 3447 (taint_state_machine::check_control_flow_arg_for_taint): New. 3448 3449 2022-11-11 David Malcolm <dmalcolm (a] redhat.com> 3450 3451 * sm-fd.dot: Fix typo in comment. 3452 * sm-file.dot: New file. 3453 * varargs.cc: Fix typo in comment. 3454 * varargs.dot: New file. 3455 3456 2022-11-11 David Malcolm <dmalcolm (a] redhat.com> 3457 3458 * checker-path.h: Split out checker_event and its subclasses to... 3459 * checker-event.h: ...this new header. 3460 3461 2022-11-11 David Malcolm <dmalcolm (a] redhat.com> 3462 3463 PR analyzer/106147 3464 * analyzer.opt (Wanalyzer-infinite-recursion): New. 3465 * call-string.cc (call_string::count_occurrences_of_function): 3466 New. 3467 * call-string.h (call_string::count_occurrences_of_function): New 3468 decl. 3469 * checker-path.cc (function_entry_event::function_entry_event): 3470 New ctor. 3471 (checker_path::add_final_event): Delete. 3472 * checker-path.h (function_entry_event::function_entry_event): New 3473 ctor. 3474 (function_entry_event::get_desc): Drop "final". 3475 (checker_path::add_final_event): Delete. 3476 * diagnostic-manager.cc 3477 (diagnostic_manager::emit_saved_diagnostic): Create the final 3478 event via a new pending_diagnostic::add_final_event vfunc, rather 3479 than checker_path::add_final_event. 3480 (diagnostic_manager::add_events_for_eedge): Create function entry 3481 events via a new pending_diagnostic::add_function_entry_event 3482 vfunc. 3483 * engine.cc (exploded_graph::process_node): When creating a new 3484 PK_BEFORE_SUPERNODE node, call 3485 exploded_graph::detect_infinite_recursion on it after adding the 3486 in-edge. 3487 * exploded-graph.h (exploded_graph::detect_infinite_recursion): 3488 New decl. 3489 (exploded_graph::find_previous_entry_to): New decl. 3490 * infinite-recursion.cc: New file. 3491 * pending-diagnostic.cc 3492 (pending_diagnostic::add_function_entry_event): New. 3493 (pending_diagnostic::add_final_event): New. 3494 * pending-diagnostic.h 3495 (pending_diagnostic::add_function_entry_event): New vfunc. 3496 (pending_diagnostic::add_final_event): New vfunc. 3497 3498 2022-11-10 David Malcolm <dmalcolm (a] redhat.com> 3499 3500 PR analyzer/99671 3501 * analyzer.opt (Wanalyzer-deref-before-check): New warning. 3502 * diagnostic-manager.cc 3503 (null_assignment_sm_context::set_next_state): Only add state 3504 change events for transition to "null" state. 3505 (null_assignment_sm_context::is_transition_to_null): New. 3506 * engine.cc (impl_region_model_context::on_pop_frame): New. 3507 * exploded-graph.h (impl_region_model_context::on_pop_frame): New 3508 decl. 3509 * program-state.cc (sm_state_map::clear_any_state): New. 3510 (sm_state_map::can_merge_with_p): New. 3511 (program_state::can_merge_with_p): Replace requirement that 3512 sm-states be equal in favor of an attempt to merge them. 3513 * program-state.h (sm_state_map::clear_any_state): New decl. 3514 (sm_state_map::can_merge_with_p): New decl. 3515 * region-model.cc (region_model::eval_condition): Make const. 3516 (region_model::pop_frame): Call ctxt->on_pop_frame. 3517 * region-model.h (region_model::eval_condition): Make const. 3518 (region_model_context::on_pop_frame): New vfunc. 3519 (noop_region_model_context::on_pop_frame): New. 3520 (region_model_context_decorator::on_pop_frame): New. 3521 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL. 3522 (allocation_state::dump_to_pp): Drop "final". 3523 (struct assumed_non_null_state): New subclass. 3524 (malloc_state_machine::m_assumed_non_null): New. 3525 (assumed_non_null_p): New. 3526 (class deref_before_check): New. 3527 (assumed_non_null_state::dump_to_pp): New. 3528 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame): 3529 New. 3530 (malloc_state_machine::maybe_assume_non_null): New. 3531 (malloc_state_machine::on_stmt): Transition from start state to 3532 "assumed-non-null" state for pointers passed to 3533 __attribute__((nonnull)) arguments, and for pointers explicitly 3534 dereferenced. Call maybe_complain_about_deref_before_check for 3535 pointers explicitly compared against NULL. 3536 (malloc_state_machine::maybe_complain_about_deref_before_check): 3537 New. 3538 (malloc_state_machine::on_deallocator_call): Also transition 3539 "assumed-non-null" states to "freed". 3540 (malloc_state_machine::on_pop_frame): New. 3541 (malloc_state_machine::maybe_get_merged_states_nonequal): New. 3542 * sm-malloc.dot: Update for changes to sm-malloc.cc. 3543 * sm.h (state_machine::on_pop_frame): New. 3544 (state_machine::maybe_get_merged_state): New. 3545 (state_machine::maybe_get_merged_states_nonequal): New. 3546 3547 2022-11-09 David Malcolm <dmalcolm (a] redhat.com> 3548 3549 * checker-path.cc (checker_event::debug): New. 3550 (checker_path::add_event): Move here from checker-path.h. Add 3551 logging. 3552 * checker-path.h (checker_event::debug): New decl. 3553 (checker_path::checker_path): Add logger param. 3554 (checker_path::add_event): Move definition from here to 3555 checker-path.cc. 3556 (checker_path::m_logger): New field. 3557 * diagnostic-manager.cc 3558 (diagnostic_manager::emit_saved_diagnostic): Pass logger to 3559 checker_path ctor. 3560 (diagnostic_manager::add_events_for_eedge): Log scope when 3561 processing a run of stmts. 3562 3563 2022-11-08 David Malcolm <dmalcolm (a] redhat.com> 3564 3565 PR analyzer/101962 3566 * region-model-impl-calls.cc: Update comment. 3567 * region-model.cc (region_model::check_symbolic_bounds): Fix 3568 layout of "void" return. Replace usage of 3569 eval_condition_without_cm with eval_condition. 3570 (region_model::eval_condition): Take over body of... 3571 (region_model::eval_condition_without_cm): ...this subroutine, 3572 dropping the latter. Eliminating this distinction avoids issues 3573 where constraints were not considered when recursing. 3574 (region_model::compare_initial_and_pointer): Update comment. 3575 (region_model::symbolic_greater_than): Replace usage of 3576 eval_condition_without_cm with eval_condition. 3577 * region-model.h 3578 (region_model::eval_condition_without_cm): Delete decl. 3579 3580 2022-11-08 David Malcolm <dmalcolm (a] redhat.com> 3581 3582 * region-model-impl-calls.cc 3583 (region_model::impl_call_errno_location): New. 3584 * region-model-manager.cc 3585 (region_model_manager::region_model_manager): Initialize 3586 m_thread_local_region and m_errno_region. 3587 * region-model-manager.h (region_model_manager::get_errno_region): 3588 New accessor. 3589 (region_model_manager::m_thread_local_region): New. 3590 (region_model_manager::m_errno_region): New. 3591 * region-model.cc (region_model::on_call_pre): Special-case 3592 "__errno_location". 3593 (region_model::set_errno): New. 3594 * region-model.h (impl_call_errno_location): New decl. 3595 (region_model::set_errno): New decl. 3596 * region.cc (thread_local_region::dump_to_pp): New. 3597 (errno_region::dump_to_pp): New. 3598 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL. 3599 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO. 3600 (class thread_local_region): New. 3601 (is_a_helper <const thread_local_region *>::test): New. 3602 (class errno_region): New. 3603 (is_a_helper <const errno_region *>::test): New. 3604 * store.cc (binding_cluster::escaped_p): New. 3605 (store::escaped_p): Treat errno as always having escaped. 3606 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and 3607 RK_ERRNO. 3608 * store.h (binding_cluster::escaped_p): Remove definition. 3609 3610 2022-11-08 David Malcolm <dmalcolm (a] redhat.com> 3611 3612 * call-info.cc (success_call_info::get_desc): Delete. 3613 (failed_call_info::get_desc): Likewise. 3614 (succeed_or_fail_call_info::get_desc): New. 3615 * call-info.h (class succeed_or_fail_call_info): New. 3616 (class success_call_info): Convert to a subclass of 3617 succeed_or_fail_call_info. 3618 (class failed_call_info): Likewise. 3619 3620 2022-11-08 David Malcolm <dmalcolm (a] redhat.com> 3621 3622 * region-model-impl-calls.cc (region_model::impl_call_strchr): 3623 Move to on_call_post. Handle both outcomes using bifurcation, 3624 rather than just the "not found" case. 3625 * region-model.cc (region_model::on_call_pre): Move 3626 BUILT_IN_STRCHR and "strchr" to... 3627 (region_model::on_call_post): ...here. 3628 3629 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3630 3631 * analyzer.h: Use std::unique_ptr for state machines from plugins. 3632 * engine.cc: Likewise. 3633 3634 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3635 3636 * analyzer.h: Use std::unique_ptr for known functions. 3637 * engine.cc: Likewise. 3638 * known-function-manager.cc: Likewise. 3639 * known-function-manager.h: Likewise. 3640 3641 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3642 3643 * analysis-plan.cc: Define INCLUDE_MEMORY before including 3644 system.h. 3645 * analyzer-pass.cc: Likewise. 3646 * analyzer-selftests.cc: Likewise. 3647 * analyzer.cc: Likewise. 3648 * analyzer.h: Use std::unique_ptr in bifurcation code. 3649 * call-string.cc: Define INCLUDE_MEMORY before including system.h. 3650 * complexity.cc: Likewise. 3651 * engine.cc: Use std::unique_ptr in bifurcation code. 3652 * exploded-graph.h: Likewise. 3653 * known-function-manager.cc: Define INCLUDE_MEMORY before 3654 including system.h. 3655 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation 3656 code. 3657 * region-model.cc: Likewise. 3658 * region-model.h: Likewise. 3659 * supergraph.cc: Define INCLUDE_MEMORY before including system.h. 3660 3661 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3662 3663 * call-info.cc: Use std::unique_ptr for checker_event. 3664 * checker-path.cc: Likewise. 3665 * checker-path.h: Likewise. 3666 * diagnostic-manager.cc: Likewise. 3667 * engine.cc: Likewise. 3668 * pending-diagnostic.cc: Likewise. 3669 * sm-signal.cc: Likewise. 3670 * varargs.cc: Likewise. 3671 3672 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3673 3674 * diagnostic-manager.cc: Include "make-unique.h". 3675 Use std::unique_ptr for feasibility_problems and exploded_path. 3676 Delete explicit saved_diagnostic dtor. 3677 * diagnostic-manager.h: Likewise. 3678 * engine.cc: Likewise. 3679 * exploded-graph.h: Likewise. 3680 * feasible-graph.cc: Likewise. 3681 * feasible-graph.h: Likewise. 3682 3683 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3684 3685 * checker-path.cc (rewind_event::rewind_event): Update for usage of 3686 std::unique_ptr on custom_edge_info. 3687 * engine.cc (exploded_node::on_longjmp): Likewise. 3688 (exploded_edge::exploded_edge): Likewise. 3689 (exploded_edge::~exploded_edge): Delete. 3690 (exploded_graph::add_function_entry): Update for usage of 3691 std::unique_ptr on custom_edge_info. 3692 (exploded_graph::add_edge): Likewise. 3693 (add_tainted_args_callback): Likewise. 3694 (exploded_graph::maybe_create_dynamic_call): Likewise. 3695 (exploded_graph::process_node): Likewise. 3696 * exploded-graph.h (exploded_edge::~exploded_edge): Delete. 3697 (exploded_edge::m_custom_info): Use std::unique_ptr. 3698 (exploded_edge::add_edge): Likewise. 3699 * sm-signal.cc (register_signal_handler::impl_transition): Use 3700 make_unique. 3701 3702 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3703 3704 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make 3705 stmt_finder const. 3706 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of 3707 m_stmt_finder. 3708 (diagnostic_manager::add_diagnostic): Make stmt_finder const. 3709 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): 3710 Likewise. 3711 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr. 3712 (diagnostic_manager::add_diagnostic): Make stmt_finder const. 3713 * engine.cc (impl_sm_context::impl_sm_context): Likewise. 3714 (impl_sm_context::m_stmt_finder): Likewise. 3715 (leak_stmt_finder::clone): Convert return type to std::unique_ptr. 3716 * exploded-graph.h (stmt_finder::clone): Likewise. 3717 3718 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3719 3720 * call-info.cc: Add define of INCLUDE_MEMORY. 3721 * call-summary.cc: Likewise. 3722 * checker-path.cc: Likewise. 3723 * constraint-manager.cc: Likewise. 3724 * diagnostic-manager.cc: Likewise. 3725 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for 3726 param d and field m_d. 3727 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d. 3728 (saved_diagnostic::add_note): Use std::unique_ptr for 3729 param pn. 3730 (saved_diagnostic::get_pending_diagnostic): Update for conversion 3731 of m_sd.m_d to unique_ptr. 3732 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for 3733 param d. Remove explicit deletion. 3734 (diagnostic_manager::add_note): Use std::unique_ptr for param pn. 3735 (diagnostic_manager::emit_saved_diagnostic): Update for conversion 3736 of m_sd.m_d to unique_ptr. 3737 (null_assignment_sm_context::warn): Use std::unique_ptr for 3738 param d. Remove explicit deletion. 3739 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use 3740 std::unique_ptr for param d. 3741 (saved_diagnostic::add_note): Likewise for param pn. 3742 (saved_diagnostic::m_d): Likewise. 3743 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for 3744 param d. 3745 (diagnostic_manager::add_note): Use std::unique_ptr for param pn. 3746 * engine.cc: Include "make-unique.h". 3747 (impl_region_model_context::warn): Update to use std::unique_ptr 3748 for param, removing explicit deletion. 3749 (impl_region_model_context::add_note): Likewise. 3750 (impl_sm_context::warn): Update to use std::unique_ptr 3751 for param. 3752 (impl_region_model_context::on_state_leak): Likewise for result of 3753 on_leak. 3754 (exploded_node::on_longjmp): Use make_unique when creating 3755 pending_diagnostic. 3756 (exploded_graph::process_node): Likewise. 3757 * exploded-graph.h (impl_region_model_context::warn): Update to 3758 use std::unique_ptr for param. 3759 (impl_region_model_context::add_note): Likewise. 3760 * feasible-graph.cc: Add define of INCLUDE_MEMORY. 3761 * pending-diagnostic.cc: Likewise. 3762 * pending-diagnostic.h: Include analyzer.sm.h" 3763 * program-point.cc: Add define of INCLUDE_MEMORY. 3764 * program-state.cc: Likewise. 3765 * region-model-asm.cc: Likewise. 3766 * region-model-impl-calls.cc: Likewise. Include "make-unique.h". 3767 (region_model::impl_call_putenv): Use make_unique when creating 3768 pending_diagnostic. 3769 * region-model-manager.cc: Add define of INCLUDE_MEMORY. 3770 * region-model-reachability.cc: Likewise. 3771 * region-model.cc: Likewise. Include "make-unique.h". 3772 (region_model::get_gassign_result): Use make_unique when creating 3773 pending_diagnostic. 3774 (region_model::check_for_poison): Likewise. 3775 (region_model::on_stmt_pre): Likewise. 3776 (region_model::check_symbolic_bounds): Likewise. 3777 (region_model::check_region_bounds): Likewise. 3778 (annotating_ctxt: make_note): Use std::unique_ptr for result. 3779 (region_model::deref_rvalue): Use make_unique when creating 3780 pending_diagnostic. 3781 (region_model::check_for_writable_region): Likewise. 3782 (region_model::check_region_size): Likewise. 3783 (region_model::check_dynamic_size_for_floats): Likewise. 3784 (region_model::maybe_complain_about_infoleak): Likewise. 3785 (noop_region_model_context::add_note): Use std::unique_ptr for 3786 param. Remove explicit deletion. 3787 * region-model.h: Include "analyzer/pending-diagnostic.h". 3788 (region_model_context::warn): Convert param to std::unique_ptr. 3789 (region_model_context::add_note): Likewise. 3790 (noop_region_model_context::warn): Likewise. 3791 (noop_region_model_context::add_note): Likewise. 3792 (region_model_context_decorator::warn): Likewise. 3793 (region_model_context_decorator::add_note): Likewise. 3794 (note_adding_context::warn): Likewise. 3795 (note_adding_context::make_note): Likewise for return type. 3796 (test_region_model_context::warn): Convert param to 3797 std::unique_ptr. 3798 * region.cc: Add define of INCLUDE_MEMORY. 3799 * sm-fd.cc: Likewise. Include "make-unique.h". 3800 (fd_state_machine::check_for_fd_attrs): Use make_unique when 3801 creating pending_diagnostics. 3802 (fd_state_machine::on_open): Likewise. 3803 (fd_state_machine::on_creat): Likewise. 3804 (fd_state_machine::check_for_dup): Likewise. 3805 (fd_state_machine::on_close): Likewise. 3806 (fd_state_machine::check_for_open_fd): Likewise. 3807 (fd_state_machine::on_leak): Likewise, converting return type to 3808 std::unique_ptr. 3809 * sm-file.cc: Add define of INCLUDE_MEMORY. Include 3810 "make-unique.h". 3811 (fileptr_state_machine::on_stmt): Use make_unique when creating 3812 pending_diagnostic. 3813 (fileptr_state_machine::on_leak): Likewise, converting return type 3814 to std::unique_ptr. 3815 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include 3816 "make-unique.h". 3817 (malloc_state_machine::on_stmt): Use make_unique when creating 3818 pending_diagnostic. 3819 (malloc_state_machine::handle_free_of_non_heap): Likewise. 3820 (malloc_state_machine::on_deallocator_call): Likewise. 3821 (malloc_state_machine::on_realloc_call): Likewise. 3822 (malloc_state_machine::on_leak): Likewise, converting return type 3823 to std::unique_ptr. 3824 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include 3825 "make-unique.h". 3826 (pattern_test_state_machine::on_condition): Use make_unique when 3827 creating pending_diagnostic. 3828 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include 3829 "make-unique.h". 3830 (sensitive_state_machine::warn_for_any_exposure): Use make_unique 3831 when creating pending_diagnostic. 3832 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include 3833 "make-unique.h". 3834 (signal_state_machine::on_stmt): Use make_unique when creating 3835 pending_diagnostic. 3836 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include 3837 "make-unique.h". 3838 (taint_state_machine::check_for_tainted_size_arg): Use make_unique 3839 when creating pending_diagnostic. 3840 (taint_state_machine::check_for_tainted_divisor): Likewise. 3841 (region_model::check_region_for_taint): Likewise. 3842 (region_model::check_dynamic_size_for_taint): Likewise. 3843 * sm.cc: Add define of INCLUDE_MEMORY. Include 3844 "analyzer/pending-diagnostic.h". 3845 (state_machine::on_leak): Move here from sm.h, changing return 3846 type to std::unique_ptr. 3847 * sm.h (state_machine::on_leak): Change return type to 3848 std::unique_ptr. Move defn of base impl to sm.cc 3849 (sm_context::warn): Convert param d to std_unique_ptr. 3850 * state-purge.cc: Add define of INCLUDE_MEMORY. 3851 * store.cc: Likewise. 3852 * svalue.cc: Likewise. 3853 * trimmed-graph.cc: Likewise. 3854 * varargs.cc: Likewise. Include "make-unique.h". 3855 (va_list_state_machine::check_for_ended_va_list): Use make_unique 3856 when creating pending_diagnostic. 3857 (va_list_state_machine::on_leak): Likewise, converting return type 3858 to std::unique_ptr. 3859 (region_model::impl_call_va_arg): Use make_unique when creating 3860 pending_diagnostic. 3861 3862 2022-11-03 David Malcolm <dmalcolm (a] redhat.com> 3863 3864 PR analyzer/107486 3865 * analyzer.cc (is_pipe_call_p): New. 3866 * analyzer.h (is_pipe_call_p): New decl. 3867 * region-model.cc (region_model::on_call_pre): Use it. 3868 (region_model::on_call_post): Likewise. 3869 3870 2022-10-26 David Malcolm <dmalcolm (a] redhat.com> 3871 3872 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked" 3873 when the mode is symbolic, rather than just on integer constants. 3874 (fd_state_machine::check_for_open_fd): Don't complain about 3875 unchecked values in the start state. 3876 3877 2022-10-26 David Malcolm <dmalcolm (a] redhat.com> 3878 3879 * sm-fd.dot: New file. 3880 3881 2022-10-24 David Malcolm <dmalcolm (a] redhat.com> 3882 3883 PR analyzer/107349 3884 * varargs.cc (get_va_copy_arg): Fix the non-pointer case. 3885 3886 2022-10-24 David Malcolm <dmalcolm (a] redhat.com> 3887 3888 PR analyzer/107345 3889 * region-model.cc (region_model::eval_condition_without_cm): 3890 Ensure that constants are on the right-hand side before checking 3891 for them. 3892 3893 2022-10-24 David Malcolm <dmalcolm (a] redhat.com> 3894 3895 * engine.cc (impl_region_model_context::get_malloc_map): Replace 3896 with... 3897 (impl_region_model_context::get_state_map_by_name): ...this. 3898 (impl_region_model_context::get_fd_map): Delete. 3899 (impl_region_model_context::get_taint_map): Delete. 3900 * exploded-graph.h (impl_region_model_context::get_fd_map): 3901 Delete. 3902 (impl_region_model_context::get_malloc_map): Delete. 3903 (impl_region_model_context::get_taint_map): Delete. 3904 (impl_region_model_context::get_state_map_by_name): New. 3905 * region-model.h (region_model_context::get_state_map_by_name): 3906 New vfunc. 3907 (region_model_context::get_fd_map): Convert from vfunc to 3908 function. 3909 (region_model_context::get_malloc_map): Likewise. 3910 (region_model_context::get_taint_map): Likewise. 3911 (noop_region_model_context::get_state_map_by_name): New. 3912 (noop_region_model_context::get_fd_map): Delete. 3913 (noop_region_model_context::get_malloc_map): Delete. 3914 (noop_region_model_context::get_taint_map): Delete. 3915 (region_model_context_decorator::get_state_map_by_name): New. 3916 (region_model_context_decorator::get_fd_map): Delete. 3917 (region_model_context_decorator::get_malloc_map): Delete. 3918 (region_model_context_decorator::get_taint_map): Delete. 3919 3920 2022-10-24 David Malcolm <dmalcolm (a] redhat.com> 3921 3922 PR analyzer/106300 3923 * engine.cc (impl_region_model_context::get_fd_map): New. 3924 * exploded-graph.h (impl_region_model_context::get_fd_map): New 3925 decl. 3926 * region-model-impl-calls.cc (region_model::impl_call_pipe): New. 3927 * region-model.cc (region_model::update_for_int_cst_return): New, 3928 based on... 3929 (region_model::update_for_zero_return): ...this. Reimplement in 3930 terms of the former. 3931 (region_model::on_call_pre): Handle "pipe" and "pipe2". 3932 (region_model::on_call_post): Likewise. 3933 * region-model.h (region_model::impl_call_pipe): New decl. 3934 (region_model::update_for_int_cst_return): New decl. 3935 (region_model::mark_as_valid_fd): New decl. 3936 (region_model_context::get_fd_map): New pure virtual fn. 3937 (noop_region_model_context::get_fd_map): New. 3938 (region_model_context_decorator::get_fd_map): New. 3939 * sm-fd.cc: Include "analyzer/program-state.h". 3940 (fd_state_machine::describe_state_change): Handle transitions from 3941 start state to valid states. 3942 (fd_state_machine::mark_as_valid_fd): New. 3943 (fd_state_machine::on_stmt): Add missing return for "creat". 3944 (region_model::mark_as_valid_fd): New. 3945 3946 2022-10-19 David Malcolm <dmalcolm (a] redhat.com> 3947 3948 PR analyzer/105765 3949 * varargs.cc (get_BT_VALIST_ARG): Rename to... 3950 (get_va_copy_arg): ...this, and update logic for determining level 3951 of indirection of va_copy's argument to use type of argument, 3952 rather than looking at va_list_type_node, to correctly handle 3953 __builtin_ms_va_copy. 3954 (get_stateful_BT_VALIST_ARG): Rename to... 3955 (get_stateful_va_copy_arg): ...this. 3956 (va_list_state_machine::on_va_copy): Update for renaming. 3957 (region_model::impl_call_va_copy): Likewise. 3958 3959 2022-10-13 David Malcolm <dmalcolm (a] redhat.com> 3960 3961 PR analyzer/107210 3962 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only 3963 attempt to extract individual bits when tree_fits_uhwi_p. 3964 3965 2022-10-07 David Malcolm <dmalcolm (a] redhat.com> 3966 3967 PR analyzer/105783 3968 * region-model.cc (selftest::get_bit): New function. 3969 (selftest::test_bits_within_svalue_folding): New. 3970 (selfftest::analyzer_region_model_cc_tests): Call it. 3971 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the 3972 case of extracting a single bit. 3973 3974 2022-10-06 David Malcolm <dmalcolm (a] redhat.com> 3975 3976 PR analyzer/107158 3977 * store.cc (store::replay_call_summary_cluster): Eliminate 3978 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with 3979 RK_DECL, avoiding an ICE due to attempting to bind a 3980 compound_svalue into a binding_cluster when an svalue in the 3981 summary cluster converts to a compound_svalue in the caller. 3982 3983 2022-10-06 David Malcolm <dmalcolm (a] redhat.com> 3984 3985 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof 3986 against NULL caller regions/svalues. 3987 3988 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 3989 3990 * analysis-plan.cc: Simplify includes. 3991 * analyzer-pass.cc: Likewise. 3992 * analyzer-selftests.cc: Likewise. 3993 * analyzer.cc: Likewise. 3994 * analyzer.h: Add includes of "json.h" and "tristate.h". 3995 * call-info.cc: Simplify includes. 3996 * call-string.cc: Likewise. 3997 * call-summary.cc: Likewise. 3998 * checker-path.cc: Likewise. 3999 * complexity.cc: Likewise. 4000 * constraint-manager.cc: Likewise. 4001 * diagnostic-manager.cc: Likewise. 4002 * engine.cc: Likewise. 4003 * feasible-graph.cc: Likewise. 4004 * known-function-manager.cc: Likewise. 4005 * pending-diagnostic.cc: Likewise. 4006 * program-point.cc: Likewise. 4007 * program-state.cc: Likewise. 4008 * region-model-asm.cc: Likewise. 4009 * region-model-impl-calls.cc: Likewise. 4010 * region-model-manager.cc: Likewise. 4011 * region-model-reachability.cc: Likewise. 4012 * region-model.cc: Likewise. 4013 * region-model.h: Include "selftest.h". 4014 * region.cc: Simplify includes. 4015 * sm-fd.cc: Likewise. 4016 * sm-file.cc: Likewise. 4017 * sm-malloc.cc: Likewise. 4018 * sm-pattern-test.cc: Likewise. 4019 * sm-sensitive.cc: Likewise. 4020 * sm-signal.cc: Likewise. 4021 * sm-taint.cc: Likewise. 4022 * sm.cc: Likewise. 4023 * state-purge.cc: Likewise. 4024 * store.cc: Likewise. 4025 * store.h: Likewise. 4026 * supergraph.cc: Likewise. 4027 * svalue.cc: Likewise. 4028 * svalue.h: Likewise. 4029 * trimmed-graph.cc: Likewise. 4030 * varargs.cc: Likewise. 4031 4032 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 4033 4034 PR analyzer/107060 4035 * call-summary.cc 4036 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL 4037 results from convert_svalue_from_summary in SK_UNARY_OP and 4038 SK_BIN_OP. 4039 * engine.cc (impl_region_model_context::on_unknown_change): Bail 4040 out on svalues that can't have associated state. 4041 * region-model-impl-calls.cc 4042 (region_model::impl_call_analyzer_get_unknown_ptr): New. 4043 * region-model.cc (region_model::on_stmt_pre): Handle 4044 "__analyzer_get_unknown_ptr". 4045 * region-model.h 4046 (region_model::impl_call_analyzer_get_unknown_ptr): New decl. 4047 * store.cc (store::replay_call_summary_cluster): Avoid trying to 4048 create binding clusters for base regions that shouldn't have them. 4049 4050 2022-10-05 Martin Liska <mliska (a] suse.cz> 4051 4052 * call-summary.cc (call_summary_replay::call_summary_replay): 4053 Remove unused variable and arguments. 4054 * call-summary.h: Likewise. 4055 * engine.cc (exploded_node::on_stmt): Likewise. 4056 (exploded_node::replay_call_summaries): Likewise. 4057 (exploded_node::replay_call_summary): Likewise. 4058 * exploded-graph.h (class exploded_node): Likewise. 4059 4060 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 4061 4062 PR analyzer/107072 4063 * analyzer-logging.h: Include "diagnostic-core.h". 4064 * analyzer.h: Include "function.h". 4065 (class call_summary): New forward decl. 4066 (class call_summary_replay): New forward decl. 4067 (struct per_function_data): New forward decl. 4068 (struct interesting_t): New forward decl. 4069 (custom_edge_info::update_state): New vfunc. 4070 * call-info.cc (custom_edge_info::update_state): New. 4071 * call-summary.cc: New file. 4072 * call-summary.h: New file. 4073 * constraint-manager.cc: Include "analyzer/call-summary.h". 4074 (class replay_fact_visitor): New. 4075 (constraint_manager::replay_call_summary): New. 4076 * constraint-manager.h (constraint_manager::replay_call_summary): 4077 New. 4078 * engine.cc: Include "analyzer/call-summary.h". 4079 (exploded_node::on_stmt): Handle call summaries. 4080 (class call_summary_edge_info): New. 4081 (exploded_node::replay_call_summaries): New. 4082 (exploded_node::replay_call_summary): New. 4083 (per_function_data::~per_function_data): New. 4084 (per_function_data::add_call_summary): Move here from header and 4085 reimplement. 4086 (exploded_graph::process_node): Call update_state rather than 4087 update_model when handling bifurcation 4088 (viz_callgraph_node::dump_dot): Use a regular label rather 4089 than an HTML table; add summaries to dump. 4090 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h", 4091 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h", 4092 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h". 4093 (exploded_node::replay_call_summaries): New decl. 4094 (exploded_node::replay_call_summary): New decl. 4095 (per_function_data::~per_function_data): New decl. 4096 (per_function_data::add_call_summary): Move implemention from 4097 header. 4098 (per_function_data::m_summaries): Update type of element. 4099 * known-function-manager.h: Include "analyzer/analyzer-logging.h". 4100 * program-point.h: Include "pretty-print.h" and 4101 "analyzer/call-string.h". 4102 * program-state.cc: Include "analyzer/call-summary.h". 4103 (sm_state_map::replay_call_summary): New. 4104 (program_state::replay_call_summary): New. 4105 * program-state.h (sm_state_map::replay_call_summary): New decl. 4106 (program_state::replay_call_summary): New decl. 4107 * region-model-manager.cc 4108 (region_model_manager::get_or_create_asm_output_svalue): New 4109 overload. 4110 * region-model-manager.h 4111 (region_model_manager::get_or_create_asm_output_svalue): New 4112 overload decl. 4113 * region-model.cc: Include "analyzer/call-summary.h". 4114 (region_model::maybe_update_for_edge): Remove call to 4115 region_model::update_for_call_summary on 4116 SUPEREDGE_INTRAPROCEDURAL_CALL. 4117 (region_model::update_for_call_summary): Delete. 4118 (region_model::replay_call_summary): New. 4119 * region-model.h (region_model::replay_call_summary): New decl. 4120 (region_model::update_for_call_summary): Delete decl. 4121 * store.cc: Include "analyzer/call-summary.h". 4122 (store::replay_call_summary): New. 4123 (store::replay_call_summary_cluster): New. 4124 * store.h: Include "tristate.h". 4125 (is_a_helper <const ana::concrete_binding *>::test): New. 4126 (store::replay_call_summary): New decl. 4127 (store::replay_call_summary_cluster): New decl. 4128 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove 4129 "static" from decl. 4130 (supergraph_call_edge): Make stmt param const. 4131 * supergraph.h: Include "ordered-hash-map.h", "cfg.h", 4132 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h". 4133 (supergraph_call_edge): Make stmt param const. 4134 (get_ultimate_function_for_cgraph_edge): New decl. 4135 * svalue.cc (compound_svalue::compound_svalue): Assert that we're 4136 not nesting compound_svalues. 4137 * svalue.h: Include "json.h", "analyzer/store.h", and 4138 "analyzer/program-point.h". 4139 (asm_output_svalue::get_num_outputs): New accessor. 4140 4141 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 4142 4143 * region-model.h: Include "analyzer/region-model-manager.h" 4144 (class region_model_manager): Move decl to... 4145 * region-model-manager.h: ...this new file. 4146 4147 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 4148 4149 * region-model-manager.cc 4150 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL. 4151 4152 2022-10-05 David Malcolm <dmalcolm (a] redhat.com> 4153 4154 * region-model-manager.cc 4155 (region_model_manager::get_or_create_widening_svalue): Use a 4156 function_point rather than a program_point. 4157 * region-model.cc (selftest::test_widening_constraints): Likewise. 4158 * region-model.h 4159 (region_model_manager::get_or_create_widening_svalue): Likewise. 4160 (model_merger::get_function_point): New. 4161 * svalue.cc (svalue::can_merge_p): Use a function_point rather 4162 than a program_point. 4163 (svalue::can_merge_p): Likewise. 4164 * svalue.h (widening_svalue::key_t): Likewise. 4165 (widening_svalue::widening_svalue): Likewise. 4166 4167 2022-09-12 Martin Liska <mliska (a] suse.cz> 4168 4169 * region-model.cc (region_model::maybe_complain_about_infoleak): 4170 Remove unused fields. 4171 4172 2022-09-11 Tim Lange <mail (a] tim-lange.me> 4173 4174 PR analyzer/106845 4175 * region-model.cc (region_model::check_region_bounds): 4176 Bail out if 0 bytes were accessed. 4177 * store.cc (byte_range::dump_to_pp): 4178 Add special case for empty ranges. 4179 (byte_range::exceeds_p): Restrict to non-empty ranges. 4180 (byte_range::falls_short_of_p): Restrict to non-empty ranges. 4181 * store.h (bit_range::empty_p): New function. 4182 (bit_range::get_last_byte_offset): Restrict to non-empty ranges. 4183 (byte_range::empty_p): New function. 4184 (byte_range::get_last_byte_offset): Restrict to non-empty ranges. 4185 4186 2022-09-09 David Malcolm <dmalcolm (a] redhat.com> 4187 4188 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New. 4189 * checker-path.cc (region_creation_event::region_creation_event): 4190 Add "capacity" and "kind" params. 4191 (region_creation_event::get_desc): Generalize to different kinds 4192 of event. 4193 (checker_path::add_region_creation_event): Convert to... 4194 (checker_path::add_region_creation_events): ...this. 4195 * checker-path.h (enum rce_kind): New. 4196 (region_creation_event::region_creation_event): Add "capacity" and 4197 "kind" params. 4198 (region_creation_event::m_capacity): New field. 4199 (region_creation_event::m_rce_kind): New field. 4200 (checker_path::add_region_creation_event): Convert to... 4201 (checker_path::add_region_creation_events): ...this. 4202 * diagnostic-manager.cc (diagnostic_manager::build_emission_path): 4203 Update for multiple region creation events. 4204 (diagnostic_manager::add_event_on_final_node): Likewise. 4205 (diagnostic_manager::add_events_for_eedge): Likewise. 4206 * region-model-impl-calls.cc (call_details::get_logger): New. 4207 * region-model.cc: Define INCLUDE_MEMORY before including 4208 "system.h". Include "gcc-rich-location.h". 4209 (class record_layout): New. 4210 (class exposure_through_uninit_copy): New. 4211 (contains_uninit_p): New. 4212 (region_model::maybe_complain_about_infoleak): New. 4213 * region-model.h (call_details::get_logger): New decl. 4214 (region_model::maybe_complain_about_infoleak): New decl. 4215 (region_model::mark_as_tainted): New decl. 4216 * sm-taint.cc (region_model::mark_as_tainted): New. 4217 4218 2022-09-09 David Malcolm <dmalcolm (a] redhat.com> 4219 4220 * analyzer.h (class known_function_manager): New forward decl. 4221 (class known_function): New. 4222 (plugin_analyzer_init_iface::register_known_function): New. 4223 * engine.cc: Include "analyzer/known-function-manager.h". 4224 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add 4225 known_fn_mgr param. 4226 (plugin_analyzer_init_impl::register_state_machine): Add 4227 LOC_SCOPE. 4228 (plugin_analyzer_init_impl::register_known_function): New. 4229 (plugin_analyzer_init_impl::m_known_fn_mgr): New. 4230 (impl_run_checkers): Update plugin callback invocation to use 4231 eng's known_function_manager. 4232 * known-function-manager.cc: New file. 4233 * known-function-manager.h: New file. 4234 * region-model-manager.cc 4235 (region_model_manager::region_model_manager): Pass logger to 4236 m_known_fn_mgr's ctor. 4237 * region-model.cc (region_model::update_for_zero_return): New. 4238 (region_model::update_for_nonzero_return): New. 4239 (maybe_simplify_upper_bound): New. 4240 (region_model::maybe_get_copy_bounds): New. 4241 (region_model::get_known_function): New. 4242 (region_model::on_call_pre): Handle plugin-supplied known 4243 functions. 4244 * region-model.h: Include "analyzer/known-function-manager.h". 4245 (region_model_manager::get_known_function_manager): New. 4246 (region_model_manager::m_known_fn_mgr): New. 4247 (call_details::get_model): New accessor. 4248 (region_model::maybe_get_copy_bounds): New decl. 4249 (region_model::update_for_zero_return): New decl. 4250 (region_model::update_for_nonzero_return): New decl. 4251 (region_model::get_known_function): New decl. 4252 (region_model::get_known_function_manager): New. 4253 4254 2022-09-08 Tim Lange <mail (a] tim-lange.me> 4255 4256 PR analyzer/106625 4257 * analyzer.h (region_offset): Eliminate m_is_symbolic member. 4258 * region-model-impl-calls.cc (region_model::impl_call_realloc): 4259 Refine implementation to be more precise. 4260 * region-model.cc (class symbolic_past_the_end): 4261 Abstract diagnostic class to complain about accesses past the end 4262 with symbolic values. 4263 (class symbolic_buffer_overflow): 4264 Concrete diagnostic class to complain about buffer overflows with 4265 symbolic values. 4266 (class symbolic_buffer_overread): 4267 Concrete diagnostic class to complain about buffer overreads with 4268 symbolic values. 4269 (region_model::check_symbolic_bounds): New function. 4270 (maybe_get_integer_cst_tree): New helper function. 4271 (region_model::check_region_bounds): 4272 Add call to check_symbolic_bounds if offset is not concrete. 4273 (region_model::eval_condition_without_cm): 4274 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues. 4275 (is_positive_svalue): New hleper function. 4276 (region_model::symbolic_greater_than): 4277 New function to handle GT_EXPR comparisons with symbolic values. 4278 (region_model::structural_equality): New function to compare 4279 whether two svalues are structured the same, i.e. evaluate to 4280 the same value. 4281 (test_struct): Reflect changes to region::calc_offset. 4282 (test_var): Likewise. 4283 (test_array_2): Likewise and add selftest with symbolic i. 4284 * region-model.h (class region_model): Add check_symbolic_bounds, 4285 symbolic_greater_than and structural_equality. 4286 * region.cc (region::get_offset): 4287 Reflect changes to region::calc_offset. 4288 (region::calc_offset): 4289 Compute the symbolic offset if the offset is not concrete. 4290 (region::get_relative_symbolic_offset): New function to return the 4291 symbolic offset in bytes relative to its parent. 4292 (field_region::get_relative_symbolic_offset): Likewise. 4293 (element_region::get_relative_symbolic_offset): Likewise. 4294 (offset_region::get_relative_symbolic_offset): Likewise. 4295 (bit_range_region::get_relative_symbolic_offset): Likewise. 4296 * region.h: Add get_relative_symbolic_offset. 4297 * store.cc (binding_key::make): 4298 Reflect changes to region::calc_offset. 4299 (binding_map::apply_ctor_val_to_range): Likewise. 4300 (binding_map::apply_ctor_pair_to_child_region): Likewise. 4301 (binding_cluster::bind_compound_sval): Likewise. 4302 (binding_cluster::get_any_binding): Likewise. 4303 (binding_cluster::maybe_get_compound_binding): Likewise. 4304 4305 2022-09-05 Tim Lange <mail (a] tim-lange.me> 4306 4307 * region-model-impl-calls.cc (region_model::impl_call_strcpy): 4308 Handle the constant string case. 4309 * region-model.cc (region_model::get_string_size): 4310 New function to get the string size from a region or svalue. 4311 * region-model.h (class region_model): Add get_string_size. 4312 4313 2022-09-05 Tim Lange <mail (a] tim-lange.me> 4314 4315 * region.cc (cast_region::get_relative_concrete_offset): 4316 New overloaded method. 4317 * region.h: Add cast_region::get_relative_concrete_offset. 4318 4319 2022-08-22 Martin Liska <mliska (a] suse.cz> 4320 4321 * region-model.cc: Add missing final keyword. 4322 4323 2022-08-18 Tim Lange <mail (a] tim-lange.me> 4324 4325 PR analyzer/106181 4326 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic. 4327 * region-model.cc (is_any_cast_p): Formatting. 4328 (region_model::check_region_size): Ensure precondition. 4329 (class imprecise_floating_point_arithmetic): New abstract 4330 diagnostic class for all floating-point related warnings. 4331 (class float_as_size_arg): Concrete diagnostic class to complain 4332 about floating-point operands inside the size argument. 4333 (class contains_floating_point_visitor): 4334 New visitor to find floating-point operands inside svalues. 4335 (region_model::check_dynamic_size_for_floats): New function. 4336 (region_model::set_dynamic_extents): 4337 Call to check_dynamic_size_for_floats. 4338 * region-model.h (class region_model): 4339 Add region_model::check_dynamic_size_for_floats. 4340 4341 2022-08-16 Martin Liska <mliska (a] suse.cz> 4342 4343 * region-model.cc: Fix -Winconsistent-missing-override clang 4344 warning. 4345 * region.h: Likewise. 4346 4347 2022-08-15 David Malcolm <dmalcolm (a] redhat.com> 4348 4349 PR analyzer/106626 4350 * region-model.cc (buffer_overread::emit): Fix copy&paste error in 4351 direction of the access in the note. 4352 4353 2022-08-15 David Malcolm <dmalcolm (a] redhat.com> 4354 4355 PR analyzer/106573 4356 * region-model.cc (region_model::on_call_pre): Use check_call_args 4357 when ensuring that we call get_arg_svalue on all args. Remove 4358 redundant call from handling for stdio builtins. 4359 4360 2022-08-15 Immad Mir <mirimmad (a] outlook.com> 4361 4362 PR analyzer/106551 4363 * sm-fd.cc (check_for_dup): exit early if first 4364 argument is invalid for all dup functions. 4365 4366 2022-08-12 Tim Lange <mail (a] tim-lange.me> 4367 4368 PR analyzer/106000 4369 * analyzer.opt: Add Wanalyzer-out-of-bounds. 4370 * region-model.cc (class out_of_bounds): Diagnostics base class 4371 for all out-of-bounds diagnostics. 4372 (class past_the_end): Base class derived from out_of_bounds for 4373 the buffer_overflow and buffer_overread diagnostics. 4374 (class buffer_overflow): Buffer overflow diagnostics. 4375 (class buffer_overread): Buffer overread diagnostics. 4376 (class buffer_underflow): Buffer underflow diagnostics. 4377 (class buffer_underread): Buffer overread diagnostics. 4378 (region_model::check_region_bounds): New function to check region 4379 bounds for out-of-bounds accesses. 4380 (region_model::check_region_access): 4381 Add call to check_region_bounds. 4382 (region_model::get_representative_tree): New function that accepts 4383 a region instead of an svalue. 4384 * region-model.h (class region_model): 4385 Add region_model::check_region_bounds. 4386 * region.cc (region::symbolic_p): New predicate. 4387 (offset_region::get_byte_size_sval): Only return the remaining 4388 byte size on offset_regions. 4389 * region.h: Add region::symbolic_p. 4390 * store.cc (byte_range::intersects_p): 4391 Add new function equivalent to bit_range::intersects_p. 4392 (byte_range::exceeds_p): New function. 4393 (byte_range::falls_short_of_p): New function. 4394 * store.h (struct byte_range): Add byte_range::intersects_p, 4395 byte_range::exceeds_p and byte_range::falls_short_of_p. 4396 4397 2022-08-12 Tim Lange <mail (a] tim-lange.me> 4398 4399 PR analyzer/106539 4400 * region-model-impl-calls.cc (region_model::impl_call_realloc): 4401 Use the result of get_copied_size as the size for the 4402 sized_regions in realloc. 4403 (success_with_move::get_copied_size): New function. 4404 4405 2022-08-11 Immad Mir <mirimmad (a] outlook.com> 4406 4407 PR analyzer/106551 4408 * sm-fd.cc (check_for_dup): handle the m_start 4409 state when transitioning the state of LHS 4410 of dup, dup2 and dup3 call. 4411 4412 2022-08-09 David Malcolm <dmalcolm (a] redhat.com> 4413 4414 PR analyzer/106573 4415 * region-model.cc (region_model::on_call_pre): Ensure that we call 4416 get_arg_svalue on all arguments. 4417 4418 2022-08-05 David Malcolm <dmalcolm (a] redhat.com> 4419 4420 PR analyzer/105947 4421 * analyzer.opt (Wanalyzer-jump-through-null): New option. 4422 * engine.cc (class jump_through_null): New. 4423 (exploded_graph::process_node): Complain about jumps through NULL 4424 function pointers. 4425 4426 2022-08-02 Immad Mir <mirimmad (a] outlook.com> 4427 4428 PR analyzer/106298 4429 * sm-fd.cc (fd_state_machine::on_open): Add 4430 creat, dup, dup2 and dup3 functions. 4431 (enum dup): New. 4432 (fd_state_machine::valid_to_unchecked_state): New. 4433 (fd_state_machine::on_creat): New. 4434 (fd_state_machine::on_dup): New. 4435 4436 2022-07-28 David Malcolm <dmalcolm (a] redhat.com> 4437 4438 PR analyzer/105893 4439 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New. 4440 * region-model-impl-calls.cc (class putenv_of_auto_var): New. 4441 (region_model::impl_call_putenv): New. 4442 * region-model.cc (region_model::on_call_pre): Handle putenv. 4443 * region-model.h (region_model::impl_call_putenv): New decl. 4444 4445 2022-07-28 David Malcolm <dmalcolm (a] redhat.com> 4446 4447 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE. 4448 * sm-taint.cc (tainted_size::emit): Likewise. 4449 4450 2022-07-28 David Malcolm <dmalcolm (a] redhat.com> 4451 4452 * region.h: Add notes to the comment describing the region 4453 class hierarchy. 4454 4455 2022-07-27 Immad Mir <mirimmad (a] outlook.com> 4456 4457 PR analyzer/106286 4458 * sm-fd.cc: 4459 (fd_diagnostic::get_meaning_for_state_change): New. 4460 4461 2022-07-26 David Malcolm <dmalcolm (a] redhat.com> 4462 4463 PR analyzer/106319 4464 * store.cc (store::set_value): Don't strip away casts if the 4465 region has NULL type. 4466 4467 2022-07-26 David Malcolm <dmalcolm (a] redhat.com> 4468 4469 * region.h (code_region::get_element): Remove stray decl. 4470 (function_region::get_element): Likewise. 4471 4472 2022-07-25 Martin Liska <mliska (a] suse.cz> 4473 4474 * sm-fd.cc: Run dos2unix and fix coding style issues. 4475 4476 2022-07-23 Immad Mir <mirimmad (a] outlook.com> 4477 4478 * sm-fd.cc (fd_param_diagnostic): New diagnostic class. 4479 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic 4480 to fd_param_diagnostic. Add new overloaded constructor. 4481 (fd_use_after_close): Likewise. 4482 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check. 4483 (double_close): Change name to fd_double_close. 4484 (enum access_directions): New. 4485 (fd_state_machine::on_stmt): Handle calls to function with the 4486 new three function attributes. 4487 (fd_state_machine::check_for_fd_attrs): New. 4488 (fd_state_machine::on_open): Use the new overloaded constructors 4489 of diagnostic classes. 4490 4491 2022-07-22 David Malcolm <dmalcolm (a] redhat.com> 4492 4493 PR analyzer/106413 4494 * varargs.cc (region_model::impl_call_va_start): Avoid iterating 4495 through non-existant variadic arguments by initializing the 4496 impl_region to "UNKNOWN" if the va_start occurs in the top-level 4497 function to the analysis. 4498 4499 2022-07-22 David Malcolm <dmalcolm (a] redhat.com> 4500 4501 PR analyzer/106401 4502 * store.cc (binding_cluster::binding_cluster): Remove overzealous 4503 assertion; we're checking for tracked_p in 4504 store::get_or_create_cluster. 4505 4506 2022-07-22 Tim Lange <mail (a] tim-lange.me> 4507 4508 PR analyzer/106394 4509 * region-model.cc (capacity_compatible_with_type): Always return true 4510 if alloc_size is zero. 4511 4512 2022-07-21 David Malcolm <dmalcolm (a] redhat.com> 4513 4514 PR analyzer/106383 4515 * varargs.cc (region_model::impl_call_va_arg): When determining if 4516 we're doing interprocedural analysis, use the stack depth of the 4517 frame in which va_start was called, rather than the current stack 4518 depth. 4519 4520 2022-07-21 David Malcolm <dmalcolm (a] redhat.com> 4521 4522 * sm-taint.cc (tainted_array_index::emit): Bulletproof against 4523 NULL m_arg. 4524 (tainted_array_index::describe_final_event): Likewise. 4525 (tainted_size::emit): Likewise. 4526 (tainted_size::describe_final_event): Likewise. 4527 4528 2022-07-21 David Malcolm <dmalcolm (a] redhat.com> 4529 4530 PR analyzer/106374 4531 * region.cc (decl_region::get_svalue_for_initializer): Bail out on 4532 untracked regions. 4533 4534 2022-07-20 David Malcolm <dmalcolm (a] redhat.com> 4535 4536 PR analyzer/106373 4537 * sm-taint.cc (taint_state_machine::on_condition): Potentially 4538 update the state of the RHS as well as the LHS. 4539 4540 2022-07-20 David Malcolm <dmalcolm (a] redhat.com> 4541 4542 PR analyzer/106359 4543 * region.h (string_region::tracked_p): New. 4544 * store.cc (binding_cluster::binding_cluster): Move here from 4545 store.h. Add assertion that base_region is tracked_p. 4546 * store.h (binding_cluster::binding_cluster): Move to store.cc. 4547 4548 2022-07-19 David Malcolm <dmalcolm (a] redhat.com> 4549 4550 PR analyzer/106321 4551 * constraint-manager.h (bounded_ranges::get_count): New. 4552 (bounded_ranges::get_range): New. 4553 * engine.cc (impl_region_model_context::on_bounded_ranges): New. 4554 * exploded-graph.h (impl_region_model_context::on_bounded_ranges): 4555 New decl. 4556 * region-model.cc (region_model::apply_constraints_for_gswitch): 4557 Potentially call ctxt->on_bounded_ranges. 4558 * region-model.h (region_model_context::on_bounded_ranges): New 4559 vfunc. 4560 (noop_region_model_context::on_bounded_ranges): New. 4561 (region_model_context_decorator::on_bounded_ranges): New. 4562 * sm-taint.cc: Include "analyzer/constraint-manager.h". 4563 (taint_state_machine::on_bounded_ranges): New. 4564 * sm.h (state_machine::on_bounded_ranges): New. 4565 4566 2022-07-19 David Malcolm <dmalcolm (a] redhat.com> 4567 4568 * engine.cc (exploded_graph::process_node): Show any description 4569 of the out-edge when logging it for consideration. 4570 4571 2022-07-15 David Malcolm <dmalcolm (a] redhat.com> 4572 4573 PR analyzer/106284 4574 * sm-taint.cc (taint_state_machine::on_condition): Handle range 4575 checks optimized by build_range_check. 4576 4577 2022-07-15 Jonathan Wakely <jwakely (a] redhat.com> 4578 4579 * call-info.cc (call_info::print): Adjust to new label_text API. 4580 * checker-path.cc (checker_event::dump): Likewise. 4581 (region_creation_event::get_desc): Likewise. 4582 (state_change_event::get_desc): Likewise. 4583 (superedge_event::should_filter_p): Likewise. 4584 (start_cfg_edge_event::get_desc): Likewise. 4585 (call_event::get_desc): Likewise. 4586 (return_event::get_desc): Likewise. 4587 (warning_event::get_desc): Likewise. 4588 (checker_path::dump): Likewise. 4589 (checker_path::debug): Likewise. 4590 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic): 4591 Likewise. 4592 (diagnostic_manager::prune_interproc_events): Likewise. 4593 * engine.cc (feasibility_state::maybe_update_for_edge): 4594 Likewise. 4595 * program-state.cc (sm_state_map::to_json): Likewise. 4596 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise. 4597 (region_model::impl_call_analyzer_dump_capacity): Likewise. 4598 * region.cc (region::to_json): Likewise. 4599 * sm-malloc.cc (inform_nonnull_attribute): Likewise. 4600 * store.cc (binding_map::to_json): Likewise. 4601 (store::to_json): Likewise. 4602 * supergraph.cc (superedge::dump): Likewise. 4603 * svalue.cc (svalue::to_json): Likewise. 4604 4605 2022-07-07 David Malcolm <dmalcolm (a] redhat.com> 4606 4607 * checker-path.cc (start_cfg_edge_event::get_desc): Update for 4608 superedge::get_description returning a label_text. 4609 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise. 4610 * supergraph.cc (superedge::dump): Likewise. 4611 (superedge::get_description): Convert return type from char * to 4612 label_text. 4613 * supergraph.h (superedge::get_description): Likewise. 4614 4615 2022-07-07 David Malcolm <dmalcolm (a] redhat.com> 4616 4617 * call-info.cc (call_info::print): Update for removal of 4618 label_text::maybe_free in favor of automatic memory management. 4619 * checker-path.cc (checker_event::dump): Likewise. 4620 (checker_event::prepare_for_emission): Likewise. 4621 (state_change_event::get_desc): Likewise. 4622 (superedge_event::should_filter_p): Likewise. 4623 (start_cfg_edge_event::get_desc): Likewise. 4624 (warning_event::get_desc): Likewise. 4625 (checker_path::dump): Likewise. 4626 (checker_path::debug): Likewise. 4627 * diagnostic-manager.cc 4628 (diagnostic_manager::prune_for_sm_diagnostic): Likewise. 4629 (diagnostic_manager::prune_interproc_events): Likewise. 4630 * program-state.cc (sm_state_map::to_json): Likewise. 4631 * region.cc (region::to_json): Likewise. 4632 * sm-malloc.cc (inform_nonnull_attribute): Likewise. 4633 * store.cc (binding_map::to_json): Likewise. 4634 (store::to_json): Likewise. 4635 * svalue.cc (svalue::to_json): Likewise. 4636 4637 2022-07-07 David Malcolm <dmalcolm (a] redhat.com> 4638 4639 PR analyzer/106225 4640 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of 4641 assignments from division to... 4642 (taint_state_machine::check_for_tainted_divisor): ...this new 4643 function. Reject warning when the divisor is known to be non-zero. 4644 * sm.cc: Include "analyzer/program-state.h". 4645 (sm_context::get_old_region_model): New. 4646 * sm.h (sm_context::get_old_region_model): New decl. 4647 4648 2022-07-06 Immad Mir <mirimmad (a] outlook.com> 4649 4650 PR analyzer/106184 4651 * sm-fd.cc (fd_state_machine): Change ordering of initialization 4652 of state m_invalid so that the order of initializers is same as 4653 the ordering of the fields in the class decl. 4654 4655 2022-07-06 Immad Mir <mirimmad (a] outlook.com> 4656 4657 * sm-fd.cc (use_after_close): save the "close" event and 4658 show it where possible. 4659 4660 2022-07-06 David Malcolm <dmalcolm (a] redhat.com> 4661 4662 PR analyzer/106204 4663 * region-model.cc (within_short_circuited_stmt_p): Move extraction 4664 of assign_stmt to caller. 4665 (due_to_ifn_deferred_init_p): New. 4666 (region_model::check_for_poison): Move extraction of assign_stmt 4667 from within_short_circuited_stmt_p to here. Share logic with 4668 call to due_to_ifn_deferred_init_p. 4669 4670 2022-07-02 Tim Lange <mail (a] tim-lange.me> 4671 4672 PR analyzer/105900 4673 * analyzer.opt: Added Wanalyzer-allocation-size. 4674 * checker-path.cc (region_creation_event::get_desc): Added call to new 4675 virtual function pending_diagnostic::describe_region_creation_event. 4676 * checker-path.h: Added region_creation_event::get_desc. 4677 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node): 4678 New function. 4679 * diagnostic-manager.h: 4680 Added diagnostic_manager::add_event_on_final_node. 4681 * pending-diagnostic.h (struct region_creation): New event_desc struct. 4682 (pending_diagnostic::describe_region_creation_event): Added virtual 4683 function to overwrite description of a region creation. 4684 * region-model.cc (class dubious_allocation_size): New class. 4685 (capacity_compatible_with_type): New helper function. 4686 (class size_visitor): New class. 4687 (struct_or_union_with_inheritance_p): New helper function. 4688 (is_any_cast_p): New helper function. 4689 (region_model::check_region_size): New function. 4690 (region_model::set_value): Added call to 4691 region_model::check_region_size. 4692 * region-model.h (class region_model): New function check_region_size. 4693 * svalue.cc (region_svalue::accept): Changed to post-order traversal. 4694 (initial_svalue::accept): Likewise. 4695 (unaryop_svalue::accept): Likewise. 4696 (binop_svalue::accept): Likewise. 4697 (sub_svalue::accept): Likewise. 4698 (repeated_svalue::accept): Likewise. 4699 (bits_within_svalue::accept): Likewise. 4700 (widening_svalue::accept): Likewise. 4701 (unmergeable_svalue::accept): Likewise. 4702 (compound_svalue::accept): Likewise. 4703 (conjured_svalue::accept): Likewise. 4704 (asm_output_svalue::accept): Likewise. 4705 (const_fn_result_svalue::accept): Likewise. 4706 4707 2022-07-02 Immad Mir <mirimmad17 (a] gmail.com> 4708 4709 PR analyzer/106003 4710 * analyzer.opt (Wanalyzer-fd-leak): New option. 4711 (Wanalyzer-fd-access-mode-mismatch): New option. 4712 (Wanalyzer-fd-use-without-check): New option. 4713 (Wanalyzer-fd-double-close): New option. 4714 (Wanalyzer-fd-use-after-close): New option. 4715 * sm.h (make_fd_state_machine): New decl. 4716 * sm.cc (make_checkers): Call make_fd_state_machine. 4717 * sm-fd.cc: New file. 4718 4719 2022-06-24 David Malcolm <dmalcolm (a] redhat.com> 4720 4721 * call-string.cc: Add includes of "analyzer/analyzer.h" 4722 and "analyzer/analyzer-logging.h". 4723 (call_string::call_string): Delete copy ctor. 4724 (call_string::operator=): Delete. 4725 (call_string::operator==): Delete. 4726 (call_string::hash): Delete. 4727 (call_string::push_call): Make const, returning the resulting 4728 call_string. 4729 (call_string::pop): Delete. 4730 (call_string::cmp_ptr_ptr): New. 4731 (call_string::validate): Assert that m_parent is non-NULL, or 4732 m_elements is empty. 4733 (call_string::call_string): Move default ctor here from 4734 call-string.h and reimplement. Add ctor taking a parent 4735 and an element. 4736 (call_string::~call_string): New. 4737 (call_string::recursive_log): New. 4738 * call-string.h (call_string::call_string): Move default ctor's 4739 defn to call-string.cc. Delete copy ctor. Add ctor taking a 4740 parent and an element. 4741 (call_string::operator=): Delete. 4742 (call_string::operator==): Delete. 4743 (call_string::hash): Delete. 4744 (call_string::push_call): Make const, returning the resulting 4745 call_string. 4746 (call_string::pop): Delete decl. 4747 (call_string::get_parent): New. 4748 (call_string::cmp_ptr_ptr): New decl. 4749 (call_string::get_top_of_stack): New. 4750 (struct call_string::hashmap_traits_t): New. 4751 (class call_string): Add friend class region_model_manager. Add 4752 DISABLE_COPY_AND_ASSIGN. 4753 (call_string::~call_string): New decl. 4754 (call_string::recursive_log): New decl. 4755 (call_string::m_parent): New field. 4756 (call_string::m_children): New field. 4757 * constraint-manager.cc (selftest::test_many_constants): Pass 4758 model manager to program_point::origin. 4759 * engine.cc (exploded_graph::exploded_graph): Likewise. 4760 (exploded_graph::add_function_entry): Likewise for 4761 program_point::from_function_entry. 4762 (add_tainted_args_callback): Likewise. 4763 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 4764 Update for change to program_point.get_call_string. 4765 (exploded_graph::process_node): Likewise. 4766 (class function_call_string_cluster): Convert m_cs from a 4767 call_string to a const call_string &. 4768 (struct function_call_string): Likewise. 4769 (pod_hash_traits<function_call_string>::hash): Use pointer_hash 4770 for m_cs. 4771 (pod_hash_traits<function_call_string>::equal): Update for change 4772 to m_cs. 4773 (root_cluster::add_node): Update for change to 4774 function_call_string. 4775 (viz_callgraph_node::dump_dot): Update for change to call_string. 4776 * exploded-graph.h (per_call_string_data::m_key): Convert to a 4777 reference. 4778 (struct eg_call_string_hash_map_traits): Delete. 4779 (exploded_graph::call_string_data_map_t): Remove traits class. 4780 * program-point.cc: Move include of "analyzer/call-string.h" to 4781 after "analyzer/analyzer-logging.h". 4782 (program_point::print): Update for conversion of m_call_string to 4783 a pointer. 4784 (program_point::to_json): Likewise. 4785 (program_point::push_to_call_stack): Update for immutability of 4786 call strings. 4787 (program_point::pop_from_call_stack): Likewise. 4788 (program_point::hash): Use pointer hashing for m_call_string. 4789 (program_point::get_function_at_depth): Update for change to 4790 m_call_string. 4791 (program_point::validate): Update for changes to call_string. 4792 (program_point::on_edge): Likewise. 4793 (program_point::origin): Move here from call-string.h. Add 4794 region_model_manager param and use it to get empty call string. 4795 (program_point::from_function_entry): Likewise. 4796 (selftest::test_function_point_ordering): Likewise. 4797 (selftest::test_function_point_ordering): Likewise. 4798 * program-point.h (program_point::program_point): Update for 4799 change to m_call_string. 4800 (program_point::get_call_string): Likewise. 4801 (program_point::get_stack_depth): Likewise. 4802 (program_point::origin): Add region_model_manager param, and move 4803 defn to call-string.cc. 4804 (program_point::from_function_entry): Likewise. 4805 (program_point::empty): Drop call_string. 4806 (program_point::deleted): Likewise. 4807 (program_point::program_point): New private ctor. 4808 (program_point::m_call_string): Convert from call_string to const 4809 call_string *. 4810 * program-state.cc (selftest::test_program_state_merging): Update 4811 for call_string changes. 4812 (selftest::test_program_state_merging_2): Likewise. 4813 * region-model-manager.cc 4814 (region_model_manager::region_model_manager): Construct 4815 m_empty_call_string. 4816 (region_model_manager::log_stats): Log the call strings. 4817 * region-model.cc (assert_region_models_merge): Pass the 4818 region_model_manager when creating program_point instances. 4819 (selftest::test_state_merging): Likewise. 4820 (selftest::test_constraint_merging): Likewise. 4821 (selftest::test_widening_constraints): Likewise. 4822 (selftest::test_iteration_1): Likewise. 4823 * region-model.h (region_model_manager::get_empty_call_string): 4824 New. 4825 (region_model_manager::m_empty_call_string): New. 4826 * sm-signal.cc (register_signal_handler::impl_transition): Update 4827 for changes to call_string. 4828 4829 2022-06-24 David Malcolm <dmalcolm (a] redhat.com> 4830 4831 * call-string.cc (call_string::calc_recursion_depth): Whitespace 4832 cleanups. 4833 (call_string::cmp): Likewise. 4834 (call_string::get_caller_node): Likewise. 4835 (call_string::validate): Likewise. 4836 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise. 4837 (exploded_graph::get_per_function_data): Likewise. 4838 (exploded_graph::maybe_create_dynamic_call): Likewise. 4839 (exploded_graph::maybe_create_dynamic_call): Likewise. 4840 (exploded_graph::process_node): Likewise. 4841 4842 2022-06-16 David Malcolm <dmalcolm (a] redhat.com> 4843 4844 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning 4845 with CWE-686 ("Function Call With Incorrect Argument Type"). 4846 4847 2022-06-16 David Malcolm <dmalcolm (a] redhat.com> 4848 4849 * varargs.cc: Include "diagnostic-metadata.h". 4850 (va_list_exhausted::emit): Associate the warning with 4851 CWE-685 ("Function Call With Incorrect Number of Arguments"). 4852 4853 2022-06-16 David Malcolm <dmalcolm (a] redhat.com> 4854 4855 * sm-file.cc (double_fclose::emit): Associate the warning with 4856 CWE-1341 ("Multiple Releases of Same Resource or Handle"). 4857 4858 2022-06-15 David Malcolm <dmalcolm (a] redhat.com> 4859 4860 PR analyzer/105962 4861 * analyzer.opt (fanalyzer-undo-inlining): New option. 4862 * checker-path.cc: Include "diagnostic-core.h" and 4863 "inlining-iterator.h". 4864 (event_kind_to_string): Handle EK_INLINED_CALL. 4865 (class inlining_info): New class. 4866 (checker_event::checker_event): Move here from checker-path.h. 4867 Store original fndecl and depth, and calculate effective fndecl 4868 and depth based on inlining information. 4869 (checker_event::dump): Emit original depth as well as effective 4870 depth when they differ; likewise for fndecl. 4871 (region_creation_event::get_desc): Use m_effective_fndecl. 4872 (inlined_call_event::get_desc): New. 4873 (inlined_call_event::get_meaning): New. 4874 (checker_path::inject_any_inlined_call_events): New. 4875 * checker-path.h (enum event_kind): Add EK_INLINED_CALL. 4876 (checker_event::checker_event): Make protected, and move 4877 definition to checker-path.cc. 4878 (checker_event::get_fndecl): Use effective fndecl. 4879 (checker_event::get_stack_depth): Use effective stack depth. 4880 (checker_event::get_logical_location): Use effective stack depth. 4881 (checker_event::get_original_stack_depth): New. 4882 (checker_event::m_fndecl): Rename to... 4883 (checker_event::m_original_fndecl): ...this. 4884 (checker_event::m_depth): Rename to... 4885 (checker_event::m_original_depth): ...this. 4886 (checker_event::m_effective_fndecl): New field. 4887 (checker_event::m_effective_depth): New field. 4888 (class inlined_call_event): New checker_event subclass. 4889 (checker_path::inject_any_inlined_call_events): New decl. 4890 * diagnostic-manager.cc: Include "inlining-iterator.h". 4891 (diagnostic_manager::emit_saved_diagnostic): Call 4892 checker_path::inject_any_inlined_call_events. 4893 (diagnostic_manager::prune_for_sm_diagnostic): Handle 4894 EK_INLINED_CALL. 4895 * engine.cc (tainted_args_function_custom_event::get_desc): Use 4896 effective fndecl. 4897 * inlining-iterator.h: New file. 4898 4899 2022-06-15 David Malcolm <dmalcolm (a] redhat.com> 4900 4901 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New. 4902 (saved_diagnostic::dump_as_dot_node): New. 4903 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl. 4904 (saved_diagnostic::dump_as_dot_node): New decl. 4905 * engine.cc (exploded_node::dump_dot): Add nodes for saved 4906 diagnostics. 4907 4908 2022-06-02 David Malcolm <dmalcolm (a] redhat.com> 4909 4910 * checker-path.cc (checker_event::get_meaning): New. 4911 (function_entry_event::get_meaning): New. 4912 (state_change_event::get_desc): Add dump of meaning of the event 4913 to the -fanalyzer-verbose-state-changes output. 4914 (state_change_event::get_meaning): New. 4915 (cfg_edge_event::get_meaning): New. 4916 (call_event::get_meaning): New. 4917 (return_event::get_meaning): New. 4918 (start_consolidated_cfg_edges_event::get_meaning): New. 4919 (warning_event::get_meaning): New. 4920 * checker-path.h: Include "tree-logical-location.h". 4921 (checker_event::checker_event): Construct m_logical_loc. 4922 (checker_event::get_logical_location): New. 4923 (checker_event::get_meaning): New decl. 4924 (checker_event::m_logical_loc): New. 4925 (function_entry_event::get_meaning): New decl. 4926 (state_change_event::get_meaning): New decl. 4927 (cfg_edge_event::get_meaning): New decl. 4928 (call_event::get_meaning): New decl. 4929 (return_event::get_meaning): New decl. 4930 (start_consolidated_cfg_edges_event::get_meaning): New. 4931 (warning_event::get_meaning): New decl. 4932 * pending-diagnostic.h: Include "diagnostic-path.h". 4933 (pending_diagnostic::get_meaning_for_state_change): New vfunc. 4934 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New 4935 vfunc impl. 4936 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change): 4937 Likewise. 4938 * sm-sensitive.cc 4939 (exposure_through_output_file::get_meaning_for_state_change): 4940 Likewise. 4941 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change): 4942 Likewise. 4943 * varargs.cc 4944 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise. 4945 4946 2022-05-23 David Malcolm <dmalcolm (a] redhat.com> 4947 4948 * call-info.cc: Add "final" and "override" to all vfunc 4949 implementations that were missing them, as appropriate. 4950 * engine.cc: Likewise. 4951 * region-model.cc: Likewise. 4952 * sm-malloc.cc: Likewise. 4953 * supergraph.h: Likewise. 4954 * svalue.cc: Likewise. 4955 * varargs.cc: Likewise. 4956 4957 2022-05-20 David Malcolm <dmalcolm (a] redhat.com> 4958 4959 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with 4960 "final" and "override". 4961 * call-info.h: Likewise. 4962 * checker-path.h: Likewise. 4963 * constraint-manager.cc: Likewise. 4964 * diagnostic-manager.cc: Likewise. 4965 * engine.cc: Likewise. 4966 * exploded-graph.h: Likewise. 4967 * feasible-graph.h: Likewise. 4968 * pending-diagnostic.h: Likewise. 4969 * region-model-impl-calls.cc: Likewise. 4970 * region-model.cc: Likewise. 4971 * region-model.h: Likewise. 4972 * region.h: Likewise. 4973 * sm-file.cc: Likewise. 4974 * sm-malloc.cc: Likewise. 4975 * sm-pattern-test.cc: Likewise. 4976 * sm-sensitive.cc: Likewise. 4977 * sm-signal.cc: Likewise. 4978 * sm-taint.cc: Likewise. 4979 * state-purge.h: Likewise. 4980 * store.cc: Likewise. 4981 * store.h: Likewise. 4982 * supergraph.h: Likewise. 4983 * svalue.h: Likewise. 4984 * trimmed-graph.h: Likewise. 4985 * varargs.cc: Likewise. 4986 4987 2022-05-16 David Malcolm <dmalcolm (a] redhat.com> 4988 4989 PR analyzer/105103 4990 * analyzer.cc (make_label_text_n): New. 4991 * analyzer.h (class var_arg_region): New forward decl. 4992 (make_label_text_n): New decl. 4993 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option. 4994 (Wanalyzer-va-list-exhausted): New option. 4995 (Wanalyzer-va-list-leak): New option. 4996 (Wanalyzer-va-list-use-after-va-end): New option. 4997 * checker-path.cc (call_event::get_desc): Split out decl access 4998 into.. 4999 (call_event::get_caller_fndecl): ...this new function and... 5000 (call_event::get_callee_fndecl): ...this new function. 5001 * checker-path.h (call_event::get_desc): Drop "FINAL". 5002 (call_event::get_caller_fndecl): New decl. 5003 (call_event::get_callee_fndecl): New decl. 5004 (class call_event): Make fields protected. 5005 * diagnostic-manager.cc (null_assignment_sm_context::warn): New 5006 overload. 5007 (null_assignment_sm_context::get_new_program_state): New. 5008 (diagnostic_manager::add_events_for_superedge): Move case 5009 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc. 5010 * engine.cc (impl_sm_context::warn): Implement new override. 5011 (impl_sm_context::get_new_program_state): New. 5012 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h", 5013 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h", 5014 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h" 5015 "analyzer/supergraph.h", "analyzer/program-state.h", 5016 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h", 5017 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h", 5018 and "analyzer/checker-path.h". 5019 (ht_ident_eq): New. 5020 (fixup_location_in_macro_p): New. 5021 (pending_diagnostic::fixup_location): New. 5022 (pending_diagnostic::add_call_event): New. 5023 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop 5024 no-op inline implementation in favor of the more complex 5025 implementation above. 5026 (pending_diagnostic::add_call_event): New vfunc. 5027 * region-model-impl-calls.cc: Include "analyzer/sm.h", 5028 "diagnostic-path.h", and "analyzer/pending-diagnostic.h". 5029 * region-model-manager.cc 5030 (region_model_manager::get_var_arg_region): New. 5031 (region_model_manager::log_stats): Log m_var_arg_regions. 5032 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG, 5033 BUILT_IN_VA_START, and BUILT_IN_VA_COPY. 5034 (region_model::on_call_post): Handle BUILT_IN_VA_END. 5035 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG. 5036 (region_model::push_frame): Push variadic arguments. 5037 * region-model.h (region_model_manager::get_var_arg_region): New 5038 decl. 5039 (region_model_manager::m_var_arg_regions): New field. 5040 (region_model::impl_call_va_start): New decl. 5041 (region_model::impl_call_va_copy): New decl. 5042 (region_model::impl_call_va_arg): New decl. 5043 (region_model::impl_call_va_end): New decl. 5044 * region.cc (alloca_region::dump_to_pp): Dump the id. 5045 (var_arg_region::dump_to_pp): New. 5046 (var_arg_region::get_frame_region): New. 5047 * region.h (enum region_kind): Add RK_VAR_ARG. 5048 (region::dyn_cast_var_arg_region): New. 5049 (class var_arg_region): New. 5050 (is_a_helper <const var_arg_region *>::test): New. 5051 (struct default_hash_traits<var_arg_region::key_t>): New. 5052 * sm.cc (make_checkers): Call make_va_list_state_machine. 5053 * sm.h (sm_context::warn): New vfunc. 5054 (sm_context::get_old_svalue): Drop unused decl. 5055 (sm_context::get_new_program_state): New vfunc. 5056 (make_va_list_state_machine): New decl. 5057 * varargs.cc: New file. 5058 5059 2022-05-16 Martin Liska <mliska (a] suse.cz> 5060 5061 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE. 5062 * function-set.cc (test_stdio_example): Likewise. 5063 * sm-file.cc (get_file_using_fns): Likewise. 5064 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise. 5065 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise. 5066 5067 2022-05-13 Richard Biener <rguenther (a] suse.de> 5068 5069 * supergraph.cc: Re-order gimple-fold.h include. 5070 5071 2022-05-11 David Malcolm <dmalcolm (a] redhat.com> 5072 5073 * checker-path.cc (state_change_event::get_desc): Call maybe_free 5074 on label_text temporaries. 5075 * diagnostic-manager.cc 5076 (diagnostic_manager::prune_for_sm_diagnostic): Likewise. 5077 * engine.cc (exploded_graph::~exploded_graph): Fix leak of 5078 m_per_point_data and m_per_call_string_data values. Simplify 5079 cleanup of m_per_function_stats and m_per_point_data values. 5080 (feasibility_state::maybe_update_for_edge): Fix leak of result of 5081 superedge::get_description. 5082 * region-model-manager.cc 5083 (region_model_manager::~region_model_manager): Move cleanup of 5084 m_setjmp_values to match the ordering of the fields within 5085 region_model_manager. Fix leak of values within 5086 m_repeated_values_map, m_bits_within_values_map, 5087 m_asm_output_values_map, and m_const_fn_result_values_map. 5088 5089 2022-04-28 David Malcolm <dmalcolm (a] redhat.com> 5090 5091 PR analyzer/105285 5092 * store.cc (binding_cluster::get_any_binding): Handle accessing 5093 sub_svalues of clusters where the base region has a symbolic 5094 binding. 5095 5096 2022-04-28 David Malcolm <dmalcolm (a] redhat.com> 5097 5098 * diagnostic-manager.cc (epath_finder::process_worklist_item): 5099 Call dump_feasible_path when a path that reaches the the target 5100 enode is found. 5101 (epath_finder::dump_feasible_path): New. 5102 * engine.cc (feasibility_state::dump_to_pp): New. 5103 * exploded-graph.h (feasibility_state::dump_to_pp): New decl. 5104 * feasible-graph.cc (feasible_graph::dump_feasible_path): New. 5105 * feasible-graph.h (feasible_graph::dump_feasible_path): New 5106 decls. 5107 * program-point.cc (function_point::print): Fix missing trailing 5108 newlines. 5109 * program-point.h (program_point::print_source_line): Remove 5110 unimplemented decl. 5111 5112 2022-04-25 David Malcolm <dmalcolm (a] redhat.com> 5113 5114 PR analyzer/105365 5115 PR analyzer/105366 5116 * svalue.cc 5117 (cmp_cst): Rename to... 5118 (cmp_csts_same_type): ...this. Convert all recursive calls to 5119 calls to... 5120 (cmp_csts_and_types): ....this new function. 5121 (svalue::cmp_ptr): Update for renaming of cmp_cst 5122 5123 2022-04-14 David Malcolm <dmalcolm (a] redhat.com> 5124 5125 PR analyzer/105264 5126 * region-model-reachability.cc (reachable_regions::handle_parm): 5127 Use maybe_get_deref_base_region rather than just region_svalue, to 5128 handle pointer arithmetic also. 5129 * svalue.cc (svalue::maybe_get_deref_base_region): New. 5130 * svalue.h (svalue::maybe_get_deref_base_region): New decl. 5131 5132 2022-04-14 David Malcolm <dmalcolm (a] redhat.com> 5133 5134 PR analyzer/105252 5135 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the 5136 types of the encoded elements before calling cmp_cst on them. 5137 5138 2022-04-09 David Malcolm <dmalcolm (a] redhat.com> 5139 5140 PR analyzer/103892 5141 * region-model-manager.cc 5142 (region_model_manager::get_unknown_symbolic_region): New, 5143 extracted from... 5144 (region_model_manager::get_field_region): ...here. 5145 (region_model_manager::get_element_region): Use it here. 5146 (region_model_manager::get_offset_region): Likewise. 5147 (region_model_manager::get_sized_region): Likewise. 5148 (region_model_manager::get_cast_region): Likewise. 5149 (region_model_manager::get_bit_range): Likewise. 5150 * region-model.h 5151 (region_model_manager::get_unknown_symbolic_region): New decl. 5152 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr 5153 having NULL type. 5154 (symbolic_region::dump_to_pp): Handle having NULL type. 5155 5156 2022-04-07 David Malcolm <dmalcolm (a] redhat.com> 5157 5158 PR analyzer/102208 5159 * store.cc (binding_map::remove_overlapping_bindings): Add 5160 "always_overlap" param, using it to generalize to the case where 5161 we want to remove all bindings. Update "uncertainty" logic to 5162 only record maybe-bound values for cases where there is a symbolic 5163 write involved. 5164 (binding_cluster::mark_region_as_unknown): Split param "reg" into 5165 "reg_to_bind" and "reg_for_overlap". 5166 (binding_cluster::maybe_get_compound_binding): Pass "false" to 5167 binding_map::remove_overlapping_bindings new "always_overlap" param. 5168 (binding_cluster::remove_overlapping_bindings): Determine 5169 "always_overlap" and pass it to 5170 binding_map::remove_overlapping_bindings. 5171 (store::set_value): Pass uncertainty to remove_overlapping_bindings 5172 call. Update for new param of 5173 binding_cluster::mark_region_as_unknown, passing both the base 5174 region of the iter_cluster, and the lhs_reg. 5175 (store::mark_region_as_unknown): Update for new param of 5176 binding_cluster::mark_region_as_unknown, passing "reg" for both. 5177 (store::remove_overlapping_bindings): Add param "uncertainty", and 5178 pass it on to call to 5179 binding_cluster::remove_overlapping_bindings. 5180 * store.h (binding_map::remove_overlapping_bindings): Add 5181 "always_overlap" param. 5182 (binding_cluster::mark_region_as_unknown): Split param "reg" into 5183 "reg_to_bind" and "reg_for_overlap". 5184 (store::remove_overlapping_bindings): Add param "uncertainty". 5185 5186 2022-03-29 David Malcolm <dmalcolm (a] redhat.com> 5187 5188 PR testsuite/105085 5189 * region-model-manager.cc (dump_untracked_region): Skip decls in 5190 the constant pool. 5191 5192 2022-03-29 David Malcolm <dmalcolm (a] redhat.com> 5193 5194 PR analyzer/105087 5195 * analyzer.h (class conjured_purge): New forward decl. 5196 * region-model-asm.cc (region_model::on_asm_stmt): Add 5197 conjured_purge param to calls binding_cluster::on_asm and 5198 region_model_manager::get_or_create_conjured_svalue. 5199 * region-model-impl-calls.cc 5200 (call_details::get_or_create_conjured_svalue): Likewise for call 5201 to region_model_manager::get_or_create_conjured_svalue. 5202 (region_model::impl_call_fgets): Remove call to 5203 region_model::purge_state_involving, as this is now done 5204 implicitly by call_details::get_or_create_conjured_svalue. 5205 (region_model::impl_call_fread): Likewise. 5206 (region_model::impl_call_strchr): Pass conjured_purge param to 5207 call to region_model_manager::get_or_create_conjured_svalue. 5208 * region-model-manager.cc (conjured_purge::purge): New. 5209 (region_model_manager::get_or_create_conjured_svalue): Add 5210 param "p". Use it to purge state when reusing an existing 5211 conjured_svalue. 5212 * region-model.cc (region_model::on_call_pre): Replace call to 5213 region_model::purge_state_involving with passing conjured_purge 5214 to region_model_manager::get_or_create_conjured_svalue. 5215 (region_model::handle_unrecognized_call): Pass conjured_purge to 5216 store::on_unknown_fncall. 5217 * region-model.h 5218 (region_model_manager::get_or_create_conjured_svalue): Add param 5219 "p". 5220 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass 5221 it on to region_model_manager::get_or_create_conjured_svalue. 5222 (binding_cluster::on_asm): Likewise. 5223 (store::on_unknown_fncall): Add param "p" and pass it on to 5224 binding_cluster::on_unknown_fncall. 5225 * store.h (binding_cluster::on_unknown_fncall): Add param p. 5226 (binding_cluster::on_asm): Likewise. 5227 (store::on_unknown_fncall): Likewise. 5228 * svalue.h (class conjured_purge): New. 5229 5230 2022-03-29 David Malcolm <dmalcolm (a] redhat.com> 5231 5232 PR analyzer/105074 5233 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl", 5234 instead using the ref->referring to get the cgraph node of the 5235 caller. 5236 (symnode_requires_tracking_p): Likewise. 5237 5238 2022-03-26 David Malcolm <dmalcolm (a] redhat.com> 5239 5240 PR analyzer/105057 5241 * store.cc (binding_cluster::make_unknown_relative_to): Reject 5242 attempts to create a cluster for untracked base regions. 5243 (store::set_value): Likewise. 5244 (store::fill_region): Likewise. 5245 (store::mark_region_as_unknown): Likewise. 5246 5247 2022-03-25 David Malcolm <dmalcolm (a] redhat.com> 5248 5249 PR analyzer/104954 5250 * analyzer.opt (-fdump-analyzer-untracked): New option. 5251 * engine.cc (impl_run_checkers): Handle it. 5252 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt 5253 to clobber regions with !tracked_p (). 5254 * region-model-manager.cc (dump_untracked_region): New. 5255 (region_model_manager::dump_untracked_regions): New. 5256 (frame_region::dump_untracked_regions): New. 5257 * region-model.h (region_model_manager::dump_untracked_regions): 5258 New decl. 5259 * region.cc (ipa_ref_requires_tracking): New. 5260 (symnode_requires_tracking_p): New. 5261 (decl_region::calc_tracked_p): New. 5262 * region.h (region::tracked_p): New vfunc. 5263 (frame_region::dump_untracked_regions): New decl. 5264 (class decl_region): Note that this is also used fo SSA names. 5265 (decl_region::decl_region): Initialize m_tracked. 5266 (decl_region::tracked_p): New. 5267 (decl_region::calc_tracked_p): New decl. 5268 (decl_region::m_tracked): New. 5269 * store.cc (store::get_or_create_cluster): Assert that we 5270 don't try to create clusters for base regions that aren't 5271 trackable. 5272 (store::mark_as_escaped): Don't mark base regions that we're not 5273 tracking. 5274 5275 2022-03-23 David Malcolm <dmalcolm (a] redhat.com> 5276 5277 PR analyzer/104979 5278 * engine.cc (impl_run_checkers): Create the engine after the 5279 supergraph, and pass the supergraph to the engine. 5280 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to 5281 frame_region::get_region_for_local. 5282 (region_model::update_for_return_gcall): Pass the lvalue for the 5283 result to pop_frame as a tree, rather than as a region. 5284 (region_model::pop_frame): Update for above change, determining 5285 the destination region after the frame is popped and thus with 5286 respect to the caller frame rather than the called frame. 5287 Likewise, set the value of the region to the return value after 5288 the frame is popped. 5289 (engine::engine): Add supergraph pointer. 5290 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs. 5291 (selftest::test_get_representative_path_var): Likewise. 5292 (selftest::test_state_merging): Likewise. 5293 * region-model.h (region_model::pop_frame): Convert first param 5294 from a const region * to a tree. 5295 (engine::engine): Add param "sg". 5296 (engine::m_sg): New field. 5297 * region.cc: Include "analyzer/sm.h" and 5298 "analyzer/program-state.h". 5299 (frame_region::get_region_for_local): Add "ctxt" param. 5300 Add assertions that VAR_DECLs are locals, and that expr is for the 5301 correct function. 5302 * region.h (frame_region::get_region_for_local): Add "ctxt" param. 5303 5304 2022-03-23 David Malcolm <dmalcolm (a] redhat.com> 5305 5306 PR analyzer/105017 5307 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check 5308 m_has_bounds as well as m_arg. 5309 (tainted_allocation_size::subclass_equal_p): Chain up to base 5310 class implementation. Also check m_mem_space. 5311 (tainted_allocation_size::emit): Add note showing stack-based vs 5312 heap-based allocations. 5313 5314 2022-03-23 David Malcolm <dmalcolm (a] redhat.com> 5315 5316 PR analyzer/104997 5317 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): 5318 Convert return type from "void" to "bool", reporting success vs 5319 failure to caller, for both overloads. 5320 * diagnostic-manager.h (diagnostic_manager::add_diagnostic): 5321 Likewise. 5322 * engine.cc (impl_region_model_context::warn): Propagate return 5323 value from diagnostic_manager::add_diagnostic. 5324 5325 2022-03-18 David Malcolm <dmalcolm (a] redhat.com> 5326 5327 PR analyzer/104943 5328 PR analyzer/104954 5329 PR analyzer/103533 5330 * analyzer.h (class state_purge_per_decl): New forward decl. 5331 * engine.cc (impl_run_checkers): Pass region_model_manager to 5332 state_purge_map ctor. 5333 * program-point.cc (function_point::final_stmt_p): New. 5334 (function_point::get_next): New. 5335 * program-point.h (function_point::final_stmt_p): New decl. 5336 (function_point::get_next): New decl. 5337 * program-state.cc (program_state::prune_for_point): Generalize to 5338 purge local decls as well as SSA names. 5339 (program_state::can_purge_base_region_p): New. 5340 * program-state.h (program_state::can_purge_base_region_p): New 5341 decl. 5342 * region-model.cc (struct append_ssa_names_cb_data): Rename to... 5343 (struct append_regions_cb_data): ...this. 5344 (region_model::get_ssa_name_regions_for_current_frame): Rename 5345 to... 5346 (region_model::get_regions_for_current_frame): ...this, updating 5347 for other renamings. 5348 (region_model::append_ssa_names_cb): Rename to... 5349 (region_model::append_regions_cb): ...this, and drop the requirement 5350 that the subregion be a SSA name. 5351 * region-model.h (struct append_ssa_names_cb_data): Rename decl 5352 to... 5353 (struct append_regions_cb_data): ...this. 5354 (region_model::get_ssa_name_regions_for_current_frame): Rename 5355 decl to... 5356 (region_model::get_regions_for_current_frame): ...this. 5357 (region_model::append_ssa_names_cb): Rename decl to... 5358 (region_model::append_regions_cb): ...this. 5359 * state-purge.cc: Include "tristate.h", "selftest.h", 5360 "analyzer/store.h", "analyzer/region-model.h", and 5361 "gimple-walk.h". 5362 (get_candidate_for_purging): New. 5363 (class gimple_op_visitor): New. 5364 (my_load_cb): New. 5365 (my_store_cb): New. 5366 (my_addr_cb): New. 5367 (state_purge_map::state_purge_map): Add "mgr" param. Update for 5368 renamings. Find uses of local variables. 5369 (state_purge_map::~state_purge_map): Update for renaming of m_map 5370 to m_ssa_map. Clean up m_decl_map. 5371 (state_purge_map::get_or_create_data_for_decl): New. 5372 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for 5373 inheriting from state_purge_per_tree. 5374 (state_purge_per_ssa_name::add_to_worklist): Likewise. 5375 (state_purge_per_decl::state_purge_per_decl): New. 5376 (state_purge_per_decl::add_needed_at): New. 5377 (state_purge_per_decl::add_pointed_to_at): New. 5378 (state_purge_per_decl::process_worklists): New. 5379 (state_purge_per_decl::add_to_worklist): New. 5380 (same_binding_p): New. 5381 (fully_overwrites_p): New. 5382 (state_purge_per_decl::process_point_backwards): New. 5383 (state_purge_per_decl::process_point_forwards): New. 5384 (state_purge_per_decl::needed_at_point_p): New. 5385 (state_purge_annotator::print_needed): Generalize to print local 5386 decls as well as SSA names. 5387 * state-purge.h (class state_purge_map): Update leading comment. 5388 (state_purge_map::map_t): Rename to... 5389 (state_purge_map::ssa_map_t): ...this. 5390 (state_purge_map::iterator): Rename to... 5391 (state_purge_map::ssa_iterator): ...this. 5392 (state_purge_map::decl_map_t): New typedef. 5393 (state_purge_map::decl_iterator): New typedef. 5394 (state_purge_map::state_purge_map): Add "mgr" param. 5395 (state_purge_map::get_data_for_ssa_name): Update for renaming. 5396 (state_purge_map::get_any_data_for_decl): New. 5397 (state_purge_map::get_or_create_data_for_decl): New decl. 5398 (state_purge_map::begin): Rename to... 5399 (state_purge_map::begin_ssas): ...this. 5400 (state_purge_map::end): Rename to... 5401 (state_purge_map::end_ssa): ...this. 5402 (state_purge_map::begin_decls): New. 5403 (state_purge_map::end_decls): New. 5404 (state_purge_map::m_map): Rename to... 5405 (state_purge_map::m_ssa_map): ...this. 5406 (state_purge_map::m_decl_map): New field. 5407 (class state_purge_per_tree): New class. 5408 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree. 5409 (state_purge_per_ssa_name::get_function): Move to base class. 5410 (state_purge_per_ssa_name::point_set_t): Likewise. 5411 (state_purge_per_ssa_name::m_fun): Likewise. 5412 (class state_purge_per_decl): New. 5413 5414 2022-03-17 David Malcolm <dmalcolm (a] redhat.com> 5415 5416 * state-purge.cc (state_purge_annotator::add_node_annotations): 5417 Avoid duplicate before-supernode annotations when returning from 5418 an interprocedural call. Show after-supernode annotations. 5419 5420 2022-03-17 David Malcolm <dmalcolm (a] redhat.com> 5421 5422 * program-point.cc (program_point::get_next): Fix missing 5423 increment of index. 5424 5425 2022-03-16 David Malcolm <dmalcolm (a] redhat.com> 5426 5427 PR analyzer/104955 5428 * diagnostic-manager.cc (get_emission_location): New. 5429 (diagnostic_manager::diagnostic_manager): Initialize 5430 m_num_disabled_diagnostics. 5431 (diagnostic_manager::add_diagnostic): Reject diagnostics that 5432 will eventually be rejected due to being disabled. 5433 (diagnostic_manager::emit_saved_diagnostics): Log the number 5434 of disabled diagnostics. 5435 (diagnostic_manager::emit_saved_diagnostic): Split out logic for 5436 determining emission location to get_emission_location. 5437 * diagnostic-manager.h 5438 (diagnostic_manager::m_num_disabled_diagnostics): New field. 5439 * engine.cc (stale_jmp_buf::get_controlling_option): New. 5440 (stale_jmp_buf::emit): Use it. 5441 * pending-diagnostic.h 5442 (pending_diagnostic::get_controlling_option): New vfunc. 5443 * region-model.cc 5444 (poisoned_value_diagnostic::get_controlling_option): New. 5445 (poisoned_value_diagnostic::emit): Use it. 5446 (shift_count_negative_diagnostic::get_controlling_option): New. 5447 (shift_count_negative_diagnostic::emit): Use it. 5448 (shift_count_overflow_diagnostic::get_controlling_option): New. 5449 (shift_count_overflow_diagnostic::emit): Use it. 5450 (dump_path_diagnostic::get_controlling_option): New. 5451 (dump_path_diagnostic::emit): Use it. 5452 (write_to_const_diagnostic::get_controlling_option): New. 5453 (write_to_const_diagnostic::emit): Use it. 5454 (write_to_string_literal_diagnostic::get_controlling_option): New. 5455 (write_to_string_literal_diagnostic::emit): Use it. 5456 * sm-file.cc (double_fclose::get_controlling_option): New. 5457 (double_fclose::emit): Use it. 5458 (file_leak::get_controlling_option): New. 5459 (file_leak::emit): Use it. 5460 * sm-malloc.cc (mismatching_deallocation::get_controlling_option): 5461 New. 5462 (mismatching_deallocation::emit): Use it. 5463 (double_free::get_controlling_option): New. 5464 (double_free::emit): Use it. 5465 (possible_null_deref::get_controlling_option): New. 5466 (possible_null_deref::emit): Use it. 5467 (possible_null_arg::get_controlling_option): New. 5468 (possible_null_arg::emit): Use it. 5469 (null_deref::get_controlling_option): New. 5470 (null_deref::emit): Use it. 5471 (null_arg::get_controlling_option): New. 5472 (null_arg::emit): Use it. 5473 (use_after_free::get_controlling_option): New. 5474 (use_after_free::emit): Use it. 5475 (malloc_leak::get_controlling_option): New. 5476 (malloc_leak::emit): Use it. 5477 (free_of_non_heap::get_controlling_option): New. 5478 (free_of_non_heap::emit): Use it. 5479 * sm-pattern-test.cc (pattern_match::get_controlling_option): New. 5480 (pattern_match::emit): Use it. 5481 * sm-sensitive.cc 5482 (exposure_through_output_file::get_controlling_option): New. 5483 (exposure_through_output_file::emit): Use it. 5484 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New. 5485 (signal_unsafe_call::emit): Use it. 5486 * sm-taint.cc (tainted_array_index::get_controlling_option): New. 5487 (tainted_array_index::emit): Use it. 5488 (tainted_offset::get_controlling_option): New. 5489 (tainted_offset::emit): Use it. 5490 (tainted_size::get_controlling_option): New. 5491 (tainted_size::emit): Use it. 5492 (tainted_divisor::get_controlling_option): New. 5493 (tainted_divisor::emit): Use it. 5494 (tainted_allocation_size::get_controlling_option): New. 5495 (tainted_allocation_size::emit): Use it. 5496 5497 2022-03-15 David Malcolm <dmalcolm (a] redhat.com> 5498 5499 * store.cc (store::store): Presize m_cluster_map. 5500 5501 2022-03-10 David Malcolm <dmalcolm (a] redhat.com> 5502 5503 PR analyzer/104863 5504 * constraint-manager.cc (constraint_manager::add_constraint): 5505 Refresh the EC IDs when adding constraints implied by offsets. 5506 5507 2022-03-10 David Malcolm <dmalcolm (a] redhat.com> 5508 5509 PR analyzer/104793 5510 * analyzer.h (class pending_note): New forward decl. 5511 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): 5512 Initialize m_notes. 5513 (saved_diagnostic::operator==): Compare m_notes. 5514 (saved_diagnostic::add_note): New. 5515 (saved_diagnostic::emit_any_notes): New. 5516 (diagnostic_manager::add_note): New. 5517 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes 5518 after emitting the warning. 5519 * diagnostic-manager.h (saved_diagnostic::add_note): New decl. 5520 (saved_diagnostic::emit_any_notes): New decl. 5521 (saved_diagnostic::m_notes): New field. 5522 (diagnostic_manager::add_note): New decl. 5523 * engine.cc (impl_region_model_context::add_note): New. 5524 * exploded-graph.h (impl_region_model_context::add_note): New 5525 decl. 5526 * pending-diagnostic.h (class pending_note): New. 5527 (class pending_note_subclass): New template. 5528 * region-model.cc (class reason_attr_access): New. 5529 (check_external_function_for_access_attr): Add class 5530 annotating_ctxt and use it when checking region. 5531 (noop_region_model_context::add_note): New. 5532 * region-model.h (region_model_context::add_note): New vfunc. 5533 (noop_region_model_context::add_note): New decl. 5534 (class region_model_context_decorator): New. 5535 (class note_adding_context): New. 5536 5537 2022-03-10 David Malcolm <dmalcolm (a] redhat.com> 5538 5539 PR analyzer/104793 5540 * region-model.cc 5541 (region_model::check_external_function_for_access_attr): New. 5542 (region_model::handle_unrecognized_call): Call it. 5543 * region-model.h 5544 (region_model::check_external_function_for_access_attr): New decl. 5545 (region_model::handle_unrecognized_call): New decl. 5546 5547 2022-03-10 David Malcolm <dmalcolm (a] redhat.com> 5548 5549 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg): 5550 Avoid generating duplicate saved_diagnostics by only handling the 5551 rdwr_map entry for the ptrarg, not the duplicate entry for the 5552 sizarg. 5553 5554 2022-03-07 David Malcolm <dmalcolm (a] redhat.com> 5555 5556 PR analyzer/101983 5557 * engine.cc (returning_from_function_p): New. 5558 (impl_region_model_context::on_state_leak): Use it when rejecting 5559 leaks at the return from "main". 5560 5561 2022-03-07 Jakub Jelinek <jakub (a] redhat.com> 5562 5563 * store.cc: Fix up duplicated word issue in a comment. 5564 * analyzer.cc: Likewise. 5565 * engine.cc: Likewise. 5566 * sm-taint.cc: Likewise. 5567 5568 2022-03-04 David Malcolm <dmalcolm (a] redhat.com> 5569 5570 PR analyzer/103521 5571 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13 5572 to 12. 5573 5574 2022-02-23 David Malcolm <dmalcolm (a] redhat.com> 5575 5576 PR analyzer/104434 5577 * analyzer.h (class const_fn_result_svalue): New decl. 5578 * region-model-impl-calls.cc (call_details::get_manager): New. 5579 * region-model-manager.cc 5580 (region_model_manager::get_or_create_const_fn_result_svalue): New. 5581 (region_model_manager::log_stats): Log 5582 m_const_fn_result_values_map. 5583 * region-model.cc (const_fn_p): New. 5584 (maybe_get_const_fn_result): New. 5585 (region_model::on_call_pre): Handle fndecls with 5586 __attribute__((const)) by calling the above rather than making 5587 a conjured_svalue. 5588 * region-model.h (visitor::visit_const_fn_result_svalue): New. 5589 (region_model_manager::get_or_create_const_fn_result_svalue): New 5590 decl. 5591 (region_model_manager::const_fn_result_values_map_t): New typedef. 5592 (region_model_manager::m_const_fn_result_values_map): New field. 5593 (call_details::get_manager): New decl. 5594 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT. 5595 (const_fn_result_svalue::dump_to_pp): New. 5596 (const_fn_result_svalue::dump_input): New. 5597 (const_fn_result_svalue::accept): New. 5598 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT. 5599 (svalue::dyn_cast_const_fn_result_svalue): New. 5600 (class const_fn_result_svalue): New. 5601 (is_a_helper <const const_fn_result_svalue *>::test): New. 5602 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>): 5603 New. 5604 5605 2022-02-17 David Malcolm <dmalcolm (a] redhat.com> 5606 5607 PR analyzer/104576 5608 * region-model.cc: Include "calls.h". 5609 (region_model::on_call_pre): Use flags_from_decl_or_type to 5610 generalize check for DECL_PURE_P to also check for ECF_CONST. 5611 5612 2022-02-16 David Malcolm <dmalcolm (a] redhat.com> 5613 5614 PR analyzer/104560 5615 * diagnostic-manager.cc (diagnostic_manager::build_emission_path): 5616 Add region creation events for globals of interest. 5617 (null_assignment_sm_context::get_old_program_state): New. 5618 (diagnostic_manager::add_events_for_eedge): Move check for 5619 changing dynamic extents from PK_BEFORE_STMT case to after the 5620 switch on the dst_point's kind so that we can emit them for the 5621 final stmt in a basic block. 5622 * engine.cc (impl_sm_context::get_old_program_state): New. 5623 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite 5624 detection of m_non_heap to use get_memory_space. 5625 (free_of_non_heap::free_of_non_heap): Add freed_reg param. 5626 (free_of_non_heap::subclass_equal_p): Update for changes to 5627 fields. 5628 (free_of_non_heap::emit): Drop m_kind in favor of 5629 get_memory_space. 5630 (free_of_non_heap::describe_state_change): Remove logic for 5631 detecting alloca. 5632 (free_of_non_heap::mark_interesting_stuff): Add region-creation of 5633 m_freed_reg. 5634 (free_of_non_heap::get_memory_space): New. 5635 (free_of_non_heap::kind): Drop enum. 5636 (free_of_non_heap::m_freed_reg): New field. 5637 (free_of_non_heap::m_kind): Drop field. 5638 (malloc_state_machine::on_stmt): Drop transition to m_non_heap. 5639 (malloc_state_machine::handle_free_of_non_heap): New function, 5640 split out from on_deallocator_call and on_realloc_call, adding 5641 detection of the freed region. 5642 (malloc_state_machine::on_deallocator_call): Use it. 5643 (malloc_state_machine::on_realloc_call): Likewise. 5644 * sm.h (sm_context::get_old_program_state): New vfunc. 5645 5646 2022-02-15 David Malcolm <dmalcolm (a] redhat.com> 5647 5648 PR analyzer/104524 5649 * region-model-manager.cc 5650 (region_model_manager::maybe_fold_sub_svalue): Only call 5651 get_or_create_cast if type is non-NULL. 5652 5653 2022-02-15 David Malcolm <dmalcolm (a] redhat.com> 5654 5655 PR analyzer/102692 5656 * exploded-graph.h (impl_region_model_context::get_stmt): New. 5657 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h", 5658 "tree-ssa-operands.h", and "ssa-iterators.h". 5659 (within_short_circuited_stmt_p): New. 5660 (region_model::check_for_poison): Don't warn about uninit values 5661 if within_short_circuited_stmt_p. 5662 * region-model.h (region_model_context::get_stmt): New vfunc. 5663 (noop_region_model_context::get_stmt): New. 5664 5665 2022-02-11 David Malcolm <dmalcolm (a] redhat.com> 5666 5667 PR analyzer/104274 5668 * region-model.cc (region_model::check_for_poison): Ignore 5669 uninitialized uses of empty types. 5670 5671 2022-02-10 David Malcolm <dmalcolm (a] redhat.com> 5672 5673 PR analyzer/98797 5674 * region-model-manager.cc 5675 (region_model_manager::maybe_fold_sub_svalue): Generalize getting 5676 individual chars of a STRING_CST from element_region to any 5677 subregion which is a concrete access of a single byte from its 5678 parent region. 5679 * region.cc (region::get_relative_concrete_byte_range): New. 5680 * region.h (region::get_relative_concrete_byte_range): New decl. 5681 5682 2022-02-09 David Malcolm <dmalcolm (a] redhat.com> 5683 5684 PR analyzer/104452 5685 * region-model.cc (selftest::test_bit_range_regions): New. 5686 (selftest::analyzer_region_model_cc_tests): Call it. 5687 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits 5688 to avoid using uninitialized data. 5689 5690 2022-02-07 David Malcolm <dmalcolm (a] redhat.com> 5691 5692 PR analyzer/104417 5693 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size): 5694 Remove overzealous assertion. 5695 (tainted_allocation_size::emit): Likewise. 5696 (region_model::check_dynamic_size_for_taint): Likewise. 5697 5698 2022-02-07 David Malcolm <dmalcolm (a] redhat.com> 5699 5700 PR analyzer/103872 5701 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 5702 Reimplement in terms of a get_store_value followed by a set_value. 5703 5704 2022-02-03 David Malcolm <dmalcolm (a] redhat.com> 5705 5706 PR analyzer/104369 5707 * engine.cc (exploded_graph::process_node): Use the node for any 5708 diagnostics, avoiding ICE if a bifurcation update adds a 5709 saved_diagnostic, such as for a tainted realloc size. 5710 * region-model-impl-calls.cc 5711 (region_model::impl_call_realloc::success_no_move::update_model): 5712 Require the old pointer to be non-NULL to be able successfully 5713 grow in place. Use model->deref_rvalue rather than maybe_get_region 5714 to support the old pointer being symbolic. 5715 (region_model::impl_call_realloc::success_with_move::update_model): 5716 Likewise. Add a constraint that the new pointer != the old pointer. 5717 Use a sized_region when setting the value of the new region. 5718 Handle the case where we don't know the dynamic size of the old 5719 region by marking the new region as unknown. 5720 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size): 5721 Update assertion to also allow for MEMSPACE_UNKNOWN. 5722 (tainted_allocation_size::emit): Likewise. 5723 (region_model::check_dynamic_size_for_taint): Likewise. 5724 5725 2022-02-03 David Malcolm <dmalcolm (a] redhat.com> 5726 5727 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use 5728 a sized_region when calling zero_fill_region. 5729 5730 2022-02-02 David Malcolm <dmalcolm (a] redhat.com> 5731 5732 * region-model.cc (region_model::on_return): Replace usage of 5733 copy_region with get_rvalue/set_value pair. 5734 (region_model::pop_frame): Likewise. 5735 (selftest::test_compound_assignment): Likewise. 5736 * region-model.h (region_model::copy_region): Delete decl. 5737 * region.cc (region_model::copy_region): Delete. 5738 5739 2022-02-02 David Malcolm <dmalcolm (a] redhat.com> 5740 5741 * region.cc (region::calc_offset): Consolidate effectively 5742 identical cases. 5743 5744 2022-02-02 David Malcolm <dmalcolm (a] redhat.com> 5745 5746 * analyzer.h (class bit_range_region): New forward decl. 5747 * region-model-manager.cc (region_model_manager::get_bit_range): 5748 New. 5749 (region_model_manager::log_stats): Handle m_bit_range_regions. 5750 * region-model.cc (region_model::get_lvalue_1): Handle 5751 BIT_FIELD_REF. 5752 * region-model.h (region_model_manager::get_bit_range): New decl. 5753 (region_model_manager::m_bit_range_regions): New field. 5754 * region.cc (region::get_base_region): Handle RK_BIT_RANGE. 5755 (region::base_region_p): Likewise. 5756 (region::calc_offset): Likewise. 5757 (bit_range_region::dump_to_pp): New. 5758 (bit_range_region::get_byte_size): New. 5759 (bit_range_region::get_bit_size): New. 5760 (bit_range_region::get_byte_size_sval): New. 5761 (bit_range_region::get_relative_concrete_offset): New. 5762 * region.h (enum region_kind): Add RK_BIT_RANGE. 5763 (region::dyn_cast_bit_range_region): New vfunc. 5764 (class bit_range_region): New. 5765 (is_a_helper <const bit_range_region *>::test): New. 5766 (default_hash_traits<bit_range_region::key_t>): New. 5767 5768 2022-02-02 David Malcolm <dmalcolm (a] redhat.com> 5769 5770 PR analyzer/104270 5771 * region-model.cc (region_model::on_call_pre): Handle 5772 IFN_DEFERRED_INIT. 5773 5774 2022-01-27 David Malcolm <dmalcolm (a] redhat.com> 5775 5776 * checker-path.cc (event_kind_to_string): Handle 5777 EK_REGION_CREATION. 5778 (region_creation_event::region_creation_event): New. 5779 (region_creation_event::get_desc): New. 5780 (checker_path::add_region_creation_event): New. 5781 * checker-path.h (enum event_kind): Add EK_REGION_CREATION. 5782 (class region_creation_event): New subclass. 5783 (checker_path::add_region_creation_event): New decl. 5784 * diagnostic-manager.cc 5785 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new 5786 param to add_events_for_eedge when handling trailing eedge. 5787 (diagnostic_manager::build_emission_path): Create an interesting_t 5788 instance, allow the pending diagnostic to populate it, and pass it 5789 to the calls to add_events_for_eedge. 5790 (diagnostic_manager::add_events_for_eedge): Add "interest" param. 5791 Use it to add region_creation_events for on-stack regions created 5792 within at function entry, and when pertinent dynamically-sized 5793 regions are created. 5794 (diagnostic_manager::prune_for_sm_diagnostic): Add case for 5795 EK_REGION_CREATION. 5796 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge): 5797 Add "interest" param. 5798 * pending-diagnostic.cc: Include "selftest.h", "tristate.h", 5799 "analyzer/call-string.h", "analyzer/program-point.h", 5800 "analyzer/store.h", and "analyzer/region-model.h". 5801 (interesting_t::add_region_creation): New. 5802 (interesting_t::dump_to_pp): New. 5803 * pending-diagnostic.h (struct interesting_t): New. 5804 (pending_diagnostic::mark_interesting_stuff): New vfunc. 5805 * region-model.cc 5806 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add 5807 (poisoned_value_diagnostic::operator==): Compare m_pkind and 5808 m_src_region fields. 5809 (poisoned_value_diagnostic::mark_interesting_stuff): New. 5810 (poisoned_value_diagnostic::m_src_region): New. 5811 (region_model::check_for_poison): Call 5812 get_region_for_poisoned_expr for uninit values and pass the resul 5813 to the diagnostic. 5814 (region_model::get_region_for_poisoned_expr): New. 5815 (region_model::deref_rvalue): Pass NULL for 5816 poisoned_value_diagnostic's src_region. 5817 * region-model.h (region_model::get_region_for_poisoned_expr): New 5818 decl. 5819 * region.h (frame_region::get_fndecl): New. 5820 5821 2022-01-27 Martin Liska <mliska (a] suse.cz> 5822 5823 PR analyzer/104247 5824 * constraint-manager.cc (bounded_ranges_manager::log_stats): 5825 Cast to long for format purpose. 5826 * region-model-manager.cc (log_uniq_map): Likewise. 5827 5828 2022-01-26 David Malcolm <dmalcolm (a] redhat.com> 5829 5830 PR analyzer/104224 5831 * region-model.cc (region_model::check_call_args): New. 5832 (region_model::on_call_pre): Call it when ignoring stdio builtins. 5833 * region-model.h (region_model::check_call_args): New decl 5834 5835 2022-01-26 David Malcolm <dmalcolm (a] redhat.com> 5836 5837 PR analyzer/94362 5838 * constraint-manager.cc (range::add_bound): Fix tests for 5839 discarding redundant constraints. Perform test for rejecting 5840 unsatisfiable constraints earlier so that they don't update 5841 the object on failure. 5842 (selftest::test_range): New. 5843 (selftest::test_constant_comparisons): Add test coverage for 5844 existing constraints becoming narrower until they are 5845 unsatisfiable. 5846 (selftest::run_constraint_manager_tests): Call test_range. 5847 5848 2022-01-22 David Malcolm <dmalcolm (a] redhat.com> 5849 5850 PR analyzer/104159 5851 * region-model-manager.cc 5852 (region_model_manager::get_or_create_cast): Bail out if the types 5853 are the same. Don't attempt to handle casts involving vector 5854 types. 5855 5856 2022-01-20 David Malcolm <dmalcolm (a] redhat.com> 5857 5858 PR analyzer/94362 5859 * constraint-manager.cc (bound::ensure_closed): Convert param to 5860 enum bound_kind. 5861 (range::constrained_to_single_element): Likewise. 5862 (range::add_bound): New. 5863 (constraint_manager::add_constraint): Handle SVAL + OFFSET 5864 compared to a constant. 5865 (constraint_manager::get_ec_bounds): Rewrite in terms of 5866 range::add_bound. 5867 (constraint_manager::eval_condition): Reject if range::add_bound 5868 fails. 5869 (selftest::test_constant_comparisons): Add test coverage for 5870 various impossible combinations of integer comparisons. 5871 * constraint-manager.h (enum bound_kind): New. 5872 (struct bound): Likewise. 5873 (bound::ensure_closed): Convert to param to enum bound_kind. 5874 (struct range): Convert to... 5875 (class range): ...this, making fields private. 5876 (range::add_bound): New decls. 5877 * region-model.cc (region_model::add_constraint): Fail if 5878 constraint_manager::add_constraint fails. 5879 5880 2022-01-18 David Malcolm <dmalcolm (a] redhat.com> 5881 5882 PR analyzer/104089 5883 * region-model-manager.cc 5884 (region_model_manager::get_or_create_constant_svalue): Assert that 5885 we have a CONSTANT_CLASS_P. 5886 (region_model_manager::maybe_fold_unaryop): Only fold a constant 5887 when fold_unary's result is a constant or a cast of a constant. 5888 5889 2022-01-18 David Malcolm <dmalcolm (a] redhat.com> 5890 5891 PR analyzer/104062 5892 * region-model-manager.cc 5893 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to 5894 NULL type when folding access to repeated svalue. 5895 5896 2022-01-17 Martin Liska <mliska (a] suse.cz> 5897 5898 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc. 5899 (is_named_call_p): Likewise. 5900 * region-model-asm.cc (deterministic_p): Likewise. 5901 * region.cc (field_region::get_relative_concrete_offset): Likewise. 5902 * sm-malloc.cc (method_p): Likewise. 5903 * supergraph.cc (superedge::dump_dot): Likewise. 5904 5905 2022-01-14 David Malcolm <dmalcolm (a] redhat.com> 5906 5907 * sm-taint.cc (taint_state_machine::combine_states): Handle combination 5908 of has_ub and has_lb. 5909 5910 2022-01-14 David Malcolm <dmalcolm (a] redhat.com> 5911 5912 PR analyzer/104029 5913 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): 5914 Remove gcc_unreachable from default case for unary ops. 5915 5916 2022-01-14 David Malcolm <dmalcolm (a] redhat.com> 5917 5918 * engine.cc: Include "stringpool.h", "attribs.h", and 5919 "tree-dfa.h". 5920 (mark_params_as_tainted): New. 5921 (class tainted_args_function_custom_event): New. 5922 (class tainted_args_function_info): New. 5923 (exploded_graph::add_function_entry): Handle functions with 5924 "tainted_args" attribute. 5925 (class tainted_args_field_custom_event): New. 5926 (class tainted_args_callback_custom_event): New. 5927 (class tainted_args_call_info): New. 5928 (add_tainted_args_callback): New. 5929 (add_any_callbacks): New. 5930 (exploded_graph::build_initial_worklist): Likewise. 5931 (exploded_graph::build_initial_worklist): Find callbacks that are 5932 reachable from global initializers, calling add_any_callbacks on 5933 them. 5934 5935 2022-01-12 David Malcolm <dmalcolm (a] redhat.com> 5936 5937 PR analyzer/103940 5938 * engine.cc (impl_sm_context::impl_sm_context): Add 5939 "unknown_side_effects" param and use it to initialize 5940 new m_unknown_side_effects field. 5941 (impl_sm_context::unknown_side_effects_p): New. 5942 (impl_sm_context::m_unknown_side_effects): New. 5943 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt 5944 ctor. 5945 * sm-taint.cc: Include "stringpool.h" and "attribs.h". 5946 (tainted_size::tainted_size): Drop "dir" param. 5947 (tainted_size::get_kind): Drop "FINAL". 5948 (tainted_size::emit): Likewise. 5949 (tainted_size::m_dir): Drop unused field. 5950 (class tainted_access_attrib_size): New subclass. 5951 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on 5952 external functions with unknown side effects. 5953 (taint_state_machine::check_for_tainted_size_arg): New. 5954 (region_model::check_region_for_taint): Drop "dir" param from 5955 tainted_size ctor. 5956 * sm.h (sm_context::unknown_side_effects_p): New. 5957 5958 2022-01-11 David Malcolm <dmalcolm (a] redhat.com> 5959 5960 PR analyzer/102692 5961 * diagnostic-manager.cc 5962 (class auto_disable_complexity_checks): Rename to... 5963 (class auto_checking_feasibility): ...this, updating 5964 the calls accordingly. 5965 (epath_finder::explore_feasible_paths): Update for renaming. 5966 * region-model-manager.cc 5967 (region_model_manager::region_model_manager): Update for change from 5968 m_check_complexity to m_checking_feasibility. 5969 (region_model_manager::reject_if_too_complex): Likewise. 5970 (region_model_manager::get_or_create_unknown_svalue): Handle 5971 m_checking_feasibility. 5972 (region_model_manager::create_unique_svalue): New. 5973 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and 5974 BIT_IOR_EXPRs on booleans where we know the result. 5975 * region-model.cc (test_binop_svalue_folding): Add test coverage 5976 for the above. 5977 * region-model.h (region_model_manager::create_unique_svalue): New 5978 decl. 5979 (region_model_manager::enable_complexity_check): Replace with... 5980 (region_model_manager::begin_checking_feasibility): ...this. 5981 (region_model_manager::disable_complexity_check): Replace with... 5982 (region_model_manager::end_checking_feasibility): ...this. 5983 (region_model_manager::m_check_complexity): Replace with... 5984 (region_model_manager::m_checking_feasibility): ...this. 5985 (region_model_manager::m_managed_dynamic_svalues): New field. 5986 5987 2022-01-08 David Malcolm <dmalcolm (a] redhat.com> 5988 5989 * engine.cc (impl_run_checkers): Pass logger to engine ctor. 5990 * region-model-manager.cc 5991 (region_model_manager::region_model_manager): Add logger param and 5992 use it to initialize m_logger. 5993 * region-model.cc (engine::engine): New. 5994 * region-model.h (region_model_manager::region_model_manager): 5995 Add logger param. 5996 (region_model_manager::get_logger): New. 5997 (region_model_manager::m_logger): New field. 5998 (engine::engine): New. 5999 * store.cc (store_manager::get_logger): New. 6000 (store::set_value): Log scope. Log when marking a cluster as 6001 unknown due to possible aliasing. 6002 * store.h (store_manager::get_logger): New decl. 6003 6004 2022-01-08 David Malcolm <dmalcolm (a] redhat.com> 6005 6006 * region-model-impl-calls.cc (cmp_decls): New. 6007 (cmp_decls_ptr_ptr): New. 6008 (region_model::impl_call_analyzer_dump_escaped): New. 6009 * region-model.cc (region_model::on_stmt_pre): Handle 6010 __analyzer_dump_escaped. 6011 * region-model.h (region_model::impl_call_analyzer_dump_escaped): 6012 New decl. 6013 * store.h (binding_cluster::get_base_region): New accessor. 6014 6015 2022-01-08 David Malcolm <dmalcolm (a] redhat.com> 6016 6017 * region.cc (region::is_named_decl_p): New. 6018 * region.h (region::is_named_decl_p): New decl. 6019 6020 2022-01-06 David Malcolm <dmalcolm (a] redhat.com> 6021 6022 PR analyzer/103546 6023 * store.cc (store::eval_alias_1): Refactor handling of decl 6024 regions, adding a test for may_be_aliased, rejecting those for 6025 which it returns false. 6026 6027 2021-12-12 Jonathan Wakely <jwakely (a] redhat.com> 6028 6029 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR. 6030 6031 2021-12-06 David Malcolm <dmalcolm (a] redhat.com> 6032 6033 PR analyzer/103533 6034 * constraint-manager.cc (equiv_class::contains_non_constant_p): 6035 New. 6036 (constraint_manager::canonicalize): Call it when determining 6037 redundant ECs. 6038 (selftest::test_purging): New selftest. 6039 (selftest::run_constraint_manager_tests): Likewise. 6040 * constraint-manager.h (equiv_class::contains_non_constant_p): 6041 New decl. 6042 6043 2021-12-01 David Malcolm <dmalcolm (a] redhat.com> 6044 6045 PR analyzer/102471 6046 * region-model-reachability.cc (reachable_regions::handle_parm): 6047 Treat all svalues within a compound parm has reachable, and those 6048 wrapped in a cast. 6049 6050 2021-11-29 David Malcolm <dmalcolm (a] redhat.com> 6051 6052 PR analyzer/103217 6053 * store.cc (binding_cluster::can_merge_p): For the "key is bound" 6054 vs "key is not bound" merger case, check that the bound svalue 6055 is mergeable before merging it to "unknown", rejecting the merger 6056 otherwise. 6057 6058 2021-11-19 David Malcolm <dmalcolm (a] redhat.com> 6059 6060 PR analyzer/103217 6061 * engine.cc (exploded_graph::get_or_create_node): Pass in 6062 m_ext_state to program_state::can_merge_with_p. 6063 (exploded_graph::process_worklist): Likewise. 6064 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 6065 Likewise. 6066 (exploded_graph::process_node): Add missing call to detect_leaks 6067 when handling phi nodes. 6068 * program-state.cc (program_state::can_merge_with_p): Add 6069 "ext_state" param. Pass it and state ptrs to 6070 region_model::can_merge_with_p. 6071 (selftest::test_program_state_merging): Update for new ext_state 6072 param of program_state::can_merge_with_p. 6073 (selftest::test_program_state_merging_2): Likewise. 6074 * program-state.h (program_state::can_purge_p): Make const. 6075 (program_state::can_merge_with_p): Add "ext_state" param. 6076 * region-model.cc: Include "analyzer/program-state.h". 6077 (region_model::can_merge_with_p): Add params "ext_state", 6078 "state_a", and "state_b", use them when creating model_merger 6079 object. 6080 (model_merger::mergeable_svalue_p): New. 6081 * region-model.h (region_model::can_merge_with_p): Add params 6082 "ext_state", "state_a", and "state_b". 6083 (model_merger::model_merger) Likewise, initializing new fields. 6084 (model_merger::mergeable_svalue_p): New decl. 6085 (model_merger::m_ext_state): New field. 6086 (model_merger::m_state_a): New field. 6087 (model_merger::m_state_b): New field. 6088 * svalue.cc (svalue::can_merge_p): Call 6089 model_merger::mergeable_svalue_p on both states and reject the 6090 merger accordingly. 6091 6092 2021-11-17 David Malcolm <dmalcolm (a] redhat.com> 6093 6094 PR analyzer/102695 6095 * region-model-impl-calls.cc (region_model::impl_call_strchr): New. 6096 * region-model-manager.cc 6097 (region_model_manager::maybe_fold_unaryop): Simplify cast to 6098 pointer type of an existing pointer to a region. 6099 * region-model.cc (region_model::on_call_pre): Handle 6100 BUILT_IN_STRCHR and "strchr". 6101 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add 6102 alternate wordings for functions and labels. 6103 (write_to_const_diagnostic::describe_final_event): Add alternate 6104 wordings for functions and labels. 6105 (region_model::check_for_writable_region): Handle RK_FUNCTION and 6106 RK_LABEL. 6107 * region-model.h (region_model::impl_call_strchr): New decl. 6108 6109 2021-11-16 David Malcolm <dmalcolm (a] redhat.com> 6110 6111 PR analyzer/102662 6112 * constraint-manager.cc (bounded_range::operator==): Require the 6113 types to be the same for equality. 6114 6115 2021-11-13 David Malcolm <dmalcolm (a] redhat.com> 6116 6117 * analyzer.opt (Wanalyzer-tainted-allocation-size): New. 6118 (Wanalyzer-tainted-divisor): New. 6119 (Wanalyzer-tainted-offset): New. 6120 (Wanalyzer-tainted-size): New. 6121 * engine.cc (impl_region_model_context::get_taint_map): New. 6122 * exploded-graph.h (impl_region_model_context::get_taint_map): 6123 New decl. 6124 * program-state.cc (sm_state_map::get_state): Call 6125 alt_get_inherited_state. 6126 (sm_state_map::impl_set_state): Modify states within 6127 compound svalues. 6128 (program_state::impl_call_analyzer_dump_state): Undo casts. 6129 (selftest::test_program_state_1): Update for new context param of 6130 create_region_for_heap_alloc. 6131 (selftest::test_program_state_merging): Likewise. 6132 * region-model-impl-calls.cc (region_model::impl_call_alloca): 6133 Likewise. 6134 (region_model::impl_call_calloc): Likewise. 6135 (region_model::impl_call_malloc): Likewise. 6136 (region_model::impl_call_operator_new): Likewise. 6137 (region_model::impl_call_realloc): Likewise. 6138 * region-model.cc (region_model::check_region_access): Call 6139 check_region_for_taint. 6140 (region_model::get_representative_path_var_1): Handle binops. 6141 (region_model::create_region_for_heap_alloc): Add "ctxt" param and 6142 pass it to set_dynamic_extents. 6143 (region_model::create_region_for_alloca): Likewise. 6144 (region_model::set_dynamic_extents): Add "ctxt" param and use it 6145 to call check_dynamic_size_for_taint. 6146 (selftest::test_state_merging): Update for new context param of 6147 create_region_for_heap_alloc. 6148 (selftest::test_malloc_constraints): Likewise. 6149 (selftest::test_malloc): Likewise. 6150 (selftest::test_alloca): Likewise for create_region_for_alloca. 6151 * region-model.h (region_model::create_region_for_heap_alloc): Add 6152 "ctxt" param. 6153 (region_model::create_region_for_alloca): Likewise. 6154 (region_model::set_dynamic_extents): Likewise. 6155 (region_model::check_dynamic_size_for_taint): New decl. 6156 (region_model::check_region_for_taint): New decl. 6157 (region_model_context::get_taint_map): New vfunc. 6158 (noop_region_model_context::get_taint_map): New. 6159 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add 6160 includes of "gimple-iterator.h", "tristate.h", "selftest.h", 6161 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h", 6162 "analyzer/supergraph.h", "analyzer/call-string.h", 6163 "analyzer/program-point.h", "analyzer/store.h", 6164 "analyzer/region-model.h", and "analyzer/program-state.h". 6165 (enum bounds): Move to top of file. 6166 (class taint_diagnostic): New. 6167 (class tainted_array_index): Convert to subclass of taint_diagnostic. 6168 (tainted_array_index::emit): Add CWE-129. Reword warning to use 6169 "attacker-controlled" rather than "tainted". 6170 (tainted_array_index::describe_state_change): Move to 6171 taint_diagnostic::describe_state_change. 6172 (tainted_array_index::describe_final_event): Reword to use 6173 "attacker-controlled" rather than "tainted". 6174 (class tainted_offset): New. 6175 (class tainted_size): New. 6176 (class tainted_divisor): New. 6177 (class tainted_allocation_size): New. 6178 (taint_state_machine::alt_get_inherited_state): New. 6179 (taint_state_machine::on_stmt): In assignment handling, remove 6180 ARRAY_REF handling in favor of check_region_for_taint. Add 6181 detection of tainted divisors. 6182 (taint_state_machine::get_taint): New. 6183 (taint_state_machine::combine_states): New. 6184 (region_model::check_region_for_taint): New. 6185 (region_model::check_dynamic_size_for_taint): New. 6186 * sm.h (state_machine::alt_get_inherited_state): New. 6187 6188 2021-11-12 David Malcolm <dmalcolm (a] redhat.com> 6189 6190 * engine.cc (exploded_node::on_stmt_pre): Return when handling 6191 "__analyzer_dump_state". 6192 6193 2021-11-11 Richard Biener <rguenther (a] suse.de> 6194 6195 * supergraph.cc: Include bitmap.h. 6196 6197 2021-11-04 David Malcolm <dmalcolm (a] redhat.com> 6198 6199 * program-state.cc (sm_state_map::dump): Use default_tree_printer 6200 as format decoder. 6201 6202 2021-09-16 Maxim Blinov <maxim.blinov (a] embecosm.com> 6203 6204 PR bootstrap/102242 6205 * engine.cc (INCLUDE_UNIQUE_PTR): Define. 6206 6207 2021-09-08 David Malcolm <dmalcolm (a] redhat.com> 6208 6209 PR analyzer/102225 6210 * analyzer.h (compat_types_p): New decl. 6211 * constraint-manager.cc 6212 (constraint_manager::get_or_add_equiv_class): Guard against NULL 6213 type when checking for pointer types. 6214 * region-model-impl-calls.cc (region_model::impl_call_realloc): 6215 Guard against NULL lhs type/region. Guard against the size value 6216 not being of a compatible type for dynamic extents. 6217 * region-model.cc (compat_types_p): Make non-static. 6218 6219 2021-08-30 David Malcolm <dmalcolm (a] redhat.com> 6220 6221 PR analyzer/99260 6222 * analyzer.h (class custom_edge_info): New class, adapted from 6223 exploded_edge::custom_info_t. Make member functions const. 6224 Make update_model return bool, converting edge param from 6225 reference to a pointer, and adding a ctxt param. 6226 (class path_context): New class. 6227 * call-info.cc: New file. 6228 * call-info.h: New file. 6229 * engine.cc: Include "analyzer/call-info.h" and <memory>. 6230 (impl_region_model_context::impl_region_model_context): Update for 6231 new m_path_ctxt field. 6232 (impl_region_model_context::bifurcate): New. 6233 (impl_region_model_context::terminate_path): New. 6234 (impl_region_model_context::get_malloc_map): New. 6235 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt 6236 field. 6237 (impl_sm_context::get_fndecl_for_call): Likewise. 6238 (impl_sm_context::set_next_state): Likewise. 6239 (impl_sm_context::warn): Likewise. 6240 (impl_sm_context::is_zero_assignment): Likewise. 6241 (impl_sm_context::get_path_context): New. 6242 (impl_sm_context::m_path_ctxt): New. 6243 (impl_region_model_context::on_condition): Update for new 6244 path_ctxt param. Handle m_enode_for_diag being NULL. 6245 (impl_region_model_context::on_phi): Update for new path_ctxt 6246 param. 6247 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls 6248 to use it as necessary. Use it to bail out after sm-handling, 6249 if needed. 6250 (exploded_node::detect_leaks): Update for new path_ctxt param. 6251 (dynamic_call_info_t::update_model): Update for conversion of 6252 exploded_edge::custom_info_t to custom_edge_info. 6253 (dynamic_call_info_t::add_events_to_path): Likewise. 6254 (rewind_info_t::update_model): Likewise. 6255 (rewind_info_t::add_events_to_path): Likewise. 6256 (exploded_edge::exploded_edge): Likewise. 6257 (exploded_graph::add_edge): Likewise. 6258 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 6259 Update for new path_ctxt param. 6260 (class impl_path_context): New. 6261 (exploded_graph::process_node): Update for new path_ctxt param. 6262 Create an impl_path_context and pass it to exploded_node::on_stmt. 6263 Use it to terminate iterating stmts if terminate_path is called 6264 on it. After processing a run of stmts, query path_ctxt to 6265 potentially terminate the analysis path, and/or to "bifurcate" the 6266 analysis into multiple additional paths. 6267 (feasibility_state::maybe_update_for_edge): Update for new 6268 update_model ctxt param. 6269 * exploded-graph.h 6270 (impl_region_model_context::impl_region_model_context): Add 6271 path_ctxt param. 6272 (impl_region_model_context::bifurcate): New. 6273 (impl_region_model_context::terminate_path): New 6274 (impl_region_model_context::get_ext_state): New. 6275 (impl_region_model_context::get_malloc_map): New. 6276 (impl_region_model_context::m_path_ctxt): New field. 6277 (exploded_node::on_stmt): Add path_ctxt param. 6278 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming 6279 to custom_edge_info, and making the changes as noted in analyzer.h 6280 above. 6281 (exploded_edge::exploded_edge): Update for these changes to 6282 exploded_edge::custom_info_t. 6283 (exploded_edge::m_custom_info): Likewise. 6284 (class dynamic_call_info_t): Likewise. 6285 (class rewind_info_t): Likewise. 6286 (exploded_graph::add_edge): Likewise. 6287 * program-state.cc (program_state::on_edge): Update for new 6288 path_ctxt param. 6289 (program_state::push_call): Likewise. 6290 (program_state::returning_call): Likewise. 6291 (program_state::prune_for_point): Likewise. 6292 * region-model-impl-calls.cc: Include "analyzer/call-info.h". 6293 (call_details::get_fndecl_for_call): New. 6294 (region_model::impl_call_realloc): Reimplement. 6295 * region-model.cc (region_model::on_call_pre): Move call to 6296 impl_call_realloc to... 6297 (region_model::on_call_post): ...here. Consolidate creation 6298 of call_details instance. 6299 (noop_region_model_context::bifurcate): New. 6300 (noop_region_model_context::terminate_path): New. 6301 * region-model.h (call_details::get_call_stmt): New. 6302 (call_details::get_fndecl_for_call): New. 6303 (region_model::on_realloc_with_move): New. 6304 (region_model_context::bifurcate): New. 6305 (region_model_context::terminate_path): New. 6306 (region_model_context::get_ext_state): New. 6307 (region_model_context::get_malloc_map): New. 6308 (noop_region_model_context::bifurcate): New. 6309 (noop_region_model_context::terminate_path): New. 6310 (noop_region_model_context::get_ext_state): New. 6311 (noop_region_model_context::get_malloc_map): New. 6312 * sm-malloc.cc: Include "analyzer/program-state.h". 6313 (malloc_state_machine::on_realloc_call): Reimplement. 6314 (malloc_state_machine::on_realloc_with_move): New. 6315 (region_model::on_realloc_with_move): New. 6316 * sm-signal.cc (class signal_delivery_edge_info_t): Update for 6317 conversion from exploded_edge::custom_info_t to custom_edge_info. 6318 * sm.h (sm_context::get_path_context): New. 6319 * svalue.cc (svalue::maybe_get_constant): Call 6320 unwrap_any_unmergeable. 6321 6322 2021-08-25 Ankur Saini <arsenic (a] sourceware.org> 6323 6324 PR analyzer/101980 6325 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create 6326 calls if max recursion limit is reached. 6327 6328 2021-08-23 David Malcolm <dmalcolm (a] redhat.com> 6329 6330 * analyzer.h (struct rejected_constraint): Convert to... 6331 (class rejected_constraint): ...this. 6332 (class bounded_ranges): New forward decl. 6333 (class bounded_ranges_manager): New forward decl. 6334 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and 6335 "tree-pretty-print.h". 6336 (can_plus_one_p): New. 6337 (plus_one): New. 6338 (can_minus_one_p): New. 6339 (minus_one): New. 6340 (bounded_range::bounded_range): New. 6341 (dump_cst): New. 6342 (bounded_range::dump_to_pp): New. 6343 (bounded_range::dump): New. 6344 (bounded_range::to_json): New. 6345 (bounded_range::set_json_attr): New. 6346 (bounded_range::contains_p): New. 6347 (bounded_range::intersects_p): New. 6348 (bounded_range::operator==): New. 6349 (bounded_range::cmp): New. 6350 (bounded_ranges::bounded_ranges): New. 6351 (bounded_ranges::bounded_ranges): New. 6352 (bounded_ranges::bounded_ranges): New. 6353 (bounded_ranges::canonicalize): New. 6354 (bounded_ranges::validate): New. 6355 (bounded_ranges::operator==): New. 6356 (bounded_ranges::dump_to_pp): New. 6357 (bounded_ranges::dump): New. 6358 (bounded_ranges::to_json): New. 6359 (bounded_ranges::eval_condition): New. 6360 (bounded_ranges::contain_p): New. 6361 (bounded_ranges::cmp): New. 6362 (bounded_ranges_manager::~bounded_ranges_manager): New. 6363 (bounded_ranges_manager::get_or_create_empty): New. 6364 (bounded_ranges_manager::get_or_create_point): New. 6365 (bounded_ranges_manager::get_or_create_range): New. 6366 (bounded_ranges_manager::get_or_create_union): New. 6367 (bounded_ranges_manager::get_or_create_intersection): New. 6368 (bounded_ranges_manager::get_or_create_inverse): New. 6369 (bounded_ranges_manager::consolidate): New. 6370 (bounded_ranges_manager::get_or_create_ranges_for_switch): New. 6371 (bounded_ranges_manager::create_ranges_for_switch): New. 6372 (bounded_ranges_manager::make_case_label_ranges): New. 6373 (bounded_ranges_manager::log_stats): New. 6374 (bounded_ranges_constraint::print): New. 6375 (bounded_ranges_constraint::to_json): New. 6376 (bounded_ranges_constraint::operator==): New. 6377 (bounded_ranges_constraint::add_to_hash): New. 6378 (constraint_manager::constraint_manager): Update for new field 6379 m_bounded_ranges_constraints. 6380 (constraint_manager::operator=): Likewise. 6381 (constraint_manager::hash): Likewise. 6382 (constraint_manager::operator==): Likewise. 6383 (constraint_manager::print): Likewise. 6384 (constraint_manager::dump_to_pp): Likewise. 6385 (constraint_manager::to_json): Likewise. 6386 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id 6387 if necessary in existing constraints when combining equivalence 6388 classes. Add similar code for handling 6389 m_bounded_ranges_constraints. 6390 (constraint_manager::add_constraint_internal): Add comment. 6391 (constraint_manager::add_bounded_ranges): New. 6392 (constraint_manager::eval_condition): Use new field 6393 m_bounded_ranges_constraints. 6394 (constraint_manager::purge): Update bounded_ranges_constraint 6395 instances. 6396 (constraint_manager::canonicalize): Update for new field. 6397 (merger_fact_visitor::on_ranges): New. 6398 (constraint_manager::for_each_fact): Use new field 6399 m_bounded_ranges_constraints. 6400 (constraint_manager::validate): Fix off-by-one error needed due 6401 to bug fixed above in add_unknown_constraint. Validate the EC IDs 6402 in m_bounded_ranges_constraints. 6403 (constraint_manager::get_range_manager): New. 6404 (selftest::assert_dump_bounded_range_eq): New. 6405 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New. 6406 (selftest::test_bounded_range): New. 6407 (selftest::assert_dump_bounded_ranges_eq): New. 6408 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New. 6409 (selftest::test_bounded_ranges): New. 6410 (selftest::run_constraint_manager_tests): Call the new selftests. 6411 * constraint-manager.h (struct bounded_range): New. 6412 (struct bounded_ranges): New. 6413 (template <> struct default_hash_traits<bounded_ranges::key_t>): New. 6414 (class bounded_ranges_manager): New. 6415 (fact_visitor::on_ranges): New pure virtual function. 6416 (class bounded_ranges_constraint): New. 6417 (constraint_manager::add_bounded_ranges): New decl. 6418 (constraint_manager::get_range_manager): New decl. 6419 (constraint_manager::m_bounded_ranges_constraints): New field. 6420 * diagnostic-manager.cc (epath_finder::process_worklist_item): 6421 Transfer ownership of rc to add_feasibility_problem. 6422 * engine.cc (feasibility_problem::dump_to_pp): Use get_model. 6423 * feasible-graph.cc (infeasible_node::dump_dot): Update for 6424 conversion of m_rc to a pointer. 6425 (feasible_graph::add_feasibility_problem): Pass RC by pointer and 6426 take ownership. 6427 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by 6428 pointer and take ownership. 6429 (infeasible_node::~infeasible_node): New. 6430 (infeasible_node::m_rc): Convert to a pointer. 6431 (feasible_graph::add_feasibility_problem): Pass RC by pointer and 6432 take ownership. 6433 * region-model-manager.cc: Include 6434 "analyzer/constraint-manager.h". 6435 (region_model_manager::region_model_manager): Initializer new 6436 field m_range_mgr. 6437 (region_model_manager::~region_model_manager): Delete it. 6438 (region_model_manager::log_stats): Call log_stats on it. 6439 * region-model.cc (region_model::add_constraint): Use new subclass 6440 rejected_op_constraint. 6441 (region_model::apply_constraints_for_gswitch): Reimplement using 6442 bounded_ranges_manager. 6443 (rejected_constraint::dump_to_pp): Convert to... 6444 (rejected_op_constraint::dump_to_pp): ...this. 6445 (rejected_ranges_constraint::dump_to_pp): New. 6446 * region-model.h (struct purge_stats): Add field 6447 m_num_bounded_ranges_constraints. 6448 (region_model_manager::get_range_manager): New. 6449 (region_model_manager::m_range_mgr): New. 6450 (region_model::get_range_manager): New. 6451 (struct rejected_constraint): Split into... 6452 (class rejected_constraint):...this new abstract base class, 6453 and... 6454 (class rejected_op_constraint): ...this new concrete subclass. 6455 (class rejected_ranges_constraint): New. 6456 * supergraph.cc: Include "tree-cfg.h". 6457 (supergraph::supergraph): Drop idx param from add_cfg_edge. 6458 (supergraph::add_cfg_edge): Drop idx param. 6459 (switch_cfg_superedge::switch_cfg_superedge): Move here from 6460 header. Populate m_case_labels with all cases which go to DST. 6461 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use 6462 m_case_labels. 6463 (switch_cfg_superedge::get_case_label): Delete. 6464 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param. 6465 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and 6466 move implementation to supergraph.cc. 6467 (switch_cfg_superedge::get_case_label): Delete. 6468 (switch_cfg_superedge::get_case_labels): New. 6469 (switch_cfg_superedge::m_idx): Delete. 6470 (switch_cfg_superedge::m_case_labels): New field. 6471 6472 2021-08-23 David Malcolm <dmalcolm (a] redhat.com> 6473 6474 PR analyzer/101875 6475 * sm-file.cc (file_diagnostic::describe_state_change): Handle 6476 change.m_expr being NULL. 6477 6478 2021-08-23 David Malcolm <dmalcolm (a] redhat.com> 6479 6480 PR analyzer/101837 6481 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is 6482 NULL, and assert that it's non-NULL before passing it to 6483 build_call_array_loc. 6484 6485 2021-08-23 David Malcolm <dmalcolm (a] redhat.com> 6486 6487 PR analyzer/101962 6488 * region-model.cc (region_model::eval_condition_without_cm): 6489 Refactor comparison against zero, adding a check for 6490 POINTER_PLUS_EXPR of non-NULL. 6491 6492 2021-08-23 David Malcolm <dmalcolm (a] redhat.com> 6493 6494 * store.cc (bit_range::intersects_p): New overload. 6495 (bit_range::operator-): New. 6496 (binding_cluster::maybe_get_compound_binding): Handle the partial 6497 overlap case. 6498 (selftest::test_bit_range_intersects_p): Add test coverage for 6499 new overload of bit_range::intersects_p. 6500 * store.h (bit_range::intersects_p): New overload. 6501 (bit_range::operator-): New. 6502 6503 2021-08-23 Ankur Saini <arsenic (a] sourceware.org> 6504 6505 PR analyzer/102020 6506 * diagnostic-manager.cc 6507 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo. 6508 6509 2021-08-21 Ankur Saini <arsenic (a] sourceware.org> 6510 6511 PR analyzer/101980 6512 * diagnostic-manager.cc 6513 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use 6514 caller_model only when the supergraph_edge doesn't exixt. 6515 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>: 6516 Likewise. 6517 * engine.cc (exploded_graph::create_dynamic_call): Rename to... 6518 (exploded_graph::maybe_create_dynamic_call): ...this, return call 6519 creation status. 6520 (exploded_graph::process_node): Handle calls which were not dynamically 6521 discovered. 6522 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to... 6523 (exploded_graph::maybe_create_dynamic_call): ...this. 6524 * region-model.cc (region_model::update_for_gcall): New param, use it 6525 to push call to frame. 6526 (region_model::update_for_call_superedge): Pass callee function to 6527 update_for_gcall. 6528 * region-model.h (region_model::update_for_gcall): New param. 6529 6530 2021-08-18 Ankur Saini <arsenic (a] sourceware.org> 6531 6532 PR analyzer/97114 6533 * region-model.cc (region_model::get_rvalue_1): Add case for 6534 OBJ_TYPE_REF. 6535 6536 2021-08-18 Ankur Saini <arsenic (a] sourceware.org> 6537 6538 PR analyzer/100546 6539 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call 6540 summaries if there is no callgraph edge 6541 * checker-path.cc (call_event::call_event): Handle calls events that 6542 are not represented by a supergraph call edge 6543 (return_event::return_event): Likewise. 6544 (call_event::get_desc): Work with new call_event structure. 6545 (return_event::get_desc): Likeise. 6546 * checker-path.h (call_event::m_src_snode): New field. 6547 (call_event::m_dest_snode): New field. 6548 (return_event::m_src_snode): New field. 6549 (return_event::m_dest_snode): New field. 6550 * diagnostic-manager.cc 6551 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: 6552 Refactor to work with edges without callgraph edge. 6553 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>: 6554 Likewise. 6555 * engine.cc (dynamic_call_info_t::update_model): New function. 6556 (dynamic_call_info_t::add_events_to_path): New function. 6557 (exploded_graph::create_dynamic_call): New function. 6558 (exploded_graph::process_node): Work with dynamically discovered calls. 6559 * exploded-graph.h (class dynamic_call_info_t): New class. 6560 (exploded_graph::create_dynamic_call): New decl. 6561 * program-point.cc (program_point::push_to_call_stack): New function. 6562 (program_point::pop_from_call_stack): New function. 6563 * program-point.h (program_point::push_to_call_stack): New decl. 6564 (program_point::pop_from_call_stack): New decl. 6565 * program-state.cc (program_state::push_call): New function. 6566 (program_state::returning_call): New function. 6567 * program-state.h (program_state::push_call): New decl. 6568 (program_state::returning_call): New decl. 6569 * region-model.cc (region_model::update_for_gcall) New function. 6570 (region_model::update_for_return_gcall): New function. 6571 (egion_model::update_for_call_superedge): Get the underlying gcall and 6572 update for gcall. 6573 (region_model::update_for_return_superedge): Likewise. 6574 * region-model.h (region_model::update_for_gcall): New decl. 6575 (region_model::update_for_return_gcall): New decl. 6576 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to 6577 work with calls without underlying cgraph edge. 6578 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite. 6579 * supergraph.h (supernode::get_returning_call) New accessor. 6580 6581 2021-08-04 David Malcolm <dmalcolm (a] redhat.com> 6582 6583 PR analyzer/101570 6584 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM 6585 case. 6586 * analyzer.h (class asm_output_svalue): New forward decl. 6587 (class reachable_regions): New forward decl. 6588 * complexity.cc (complexity::from_vec_svalue): New. 6589 * complexity.h (complexity::from_vec_svalue): New decl. 6590 * engine.cc (feasibility_state::maybe_update_for_edge): Handle 6591 asm stmts by calling on_asm_stmt. 6592 * region-model-asm.cc: New file. 6593 * region-model-manager.cc 6594 (region_model_manager::maybe_fold_asm_output_svalue): New. 6595 (region_model_manager::get_or_create_asm_output_svalue): New. 6596 (region_model_manager::log_stats): Log m_asm_output_values_map. 6597 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM. 6598 * region-model.h (visitor::visit_asm_output_svalue): New. 6599 (region_model_manager::get_or_create_asm_output_svalue): New decl. 6600 (region_model_manager::maybe_fold_asm_output_svalue): New decl. 6601 (region_model_manager::asm_output_values_map_t): New typedef. 6602 (region_model_manager::m_asm_output_values_map): New field. 6603 (region_model::on_asm_stmt): New. 6604 * store.cc (binding_cluster::on_asm): New. 6605 * store.h (binding_cluster::on_asm): New decl. 6606 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT. 6607 (asm_output_svalue::dump_to_pp): New. 6608 (asm_output_svalue::dump_input): New. 6609 (asm_output_svalue::input_idx_to_asm_idx): New. 6610 (asm_output_svalue::accept): New. 6611 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT. 6612 (svalue::dyn_cast_asm_output_svalue): New. 6613 (class asm_output_svalue): New. 6614 (is_a_helper <const asm_output_svalue *>::test): New. 6615 (struct default_hash_traits<asm_output_svalue::key_t>): New. 6616 6617 2021-08-03 Jakub Jelinek <jakub (a] redhat.com> 6618 6619 PR analyzer/101721 6620 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on 6621 BUILT_IN_NORMAL builtins. 6622 6623 2021-07-29 Ankur Saini <arsenic (a] sourceware.org> 6624 6625 * call-string.cc (call_string::element_t::operator==): New operator. 6626 (call_String::element_t::operator!=): New operator. 6627 (call_string::element_t::get_caller_function): New function. 6628 (call_string::element_t::get_callee_function): New function. 6629 (call_string::call_string): Refactor to Initialise m_elements. 6630 (call_string::operator=): Refactor to work with m_elements. 6631 (call_string::operator==): Likewise. 6632 (call_string::to_json): Likewise. 6633 (call_string::hash): Refactor to hash e.m_caller. 6634 (call_string::push_call): Refactor to work with m_elements. 6635 (call_string::push_call): New overload to push call via supernodes. 6636 (call_string::pop): Refactor to work with m_elements. 6637 (call_string::calc_recursion_depth): Likewise. 6638 (call_string::cmp): Likewise. 6639 (call_string::validate): Likewise. 6640 (call_string::operator[]): Likewise. 6641 * call-string.h (class supernode): New forward decl. 6642 (struct call_string::element_t): New struct. 6643 (call_string::call_string): Refactor to initialise m_elements. 6644 (call_string::bool empty_p): Refactor to work with m_elements. 6645 (call_string::get_callee_node): New decl. 6646 (call_string::get_caller_node): New decl. 6647 (m_elements): Replaces m_return_edges. 6648 * program-point.cc (program_point::get_function_at_depth): Refactor to 6649 work with new call-string format. 6650 (program_point::validate): Likewise. 6651 (program_point::on_edge): Likewise. 6652 6653 2021-07-28 David Malcolm <dmalcolm (a] redhat.com> 6654 6655 * region-model.cc (region_model::on_call_pre): Treat 6656 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE 6657 as no-ops, rather than handling them as unknown functions. 6658 6659 2021-07-28 David Malcolm <dmalcolm (a] redhat.com> 6660 6661 * region-model-impl-calls.cc (region_model::impl_call_alloca): 6662 Drop redundant return value. 6663 (region_model::impl_call_builtin_expect): Likewise. 6664 (region_model::impl_call_calloc): Likewise. 6665 (region_model::impl_call_malloc): Likewise. 6666 (region_model::impl_call_memset): Likewise. 6667 (region_model::impl_call_operator_new): Likewise. 6668 (region_model::impl_call_operator_delete): Likewise. 6669 (region_model::impl_call_strlen): Likewise. 6670 * region-model.cc (region_model::on_call_pre): Fix return value of 6671 known functions that don't have unknown side-effects. 6672 * region-model.h (region_model::impl_call_alloca): Drop redundant 6673 return value. 6674 (region_model::impl_call_builtin_expect): Likewise. 6675 (region_model::impl_call_calloc): Likewise. 6676 (region_model::impl_call_malloc): Likewise. 6677 (region_model::impl_call_memset): Likewise. 6678 (region_model::impl_call_strlen): Likewise. 6679 (region_model::impl_call_operator_new): Likewise. 6680 (region_model::impl_call_operator_delete): Likewise. 6681 6682 2021-07-28 Siddhesh Poyarekar <siddhesh (a] gotplt.org> 6683 6684 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make 6685 first argument a const_tree. 6686 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise. 6687 * sm-malloc.cc (known_allocator_p): New function. 6688 (malloc_state_machine::on_stmt): Use it. 6689 6690 2021-07-28 Siddhesh Poyarekar <siddhesh (a] gotplt.org> 6691 6692 * sm-malloc.cc 6693 (malloc_state_machine::get_or_create_deallocator): Recognize 6694 __builtin_free. 6695 6696 2021-07-26 David Malcolm <dmalcolm (a] redhat.com> 6697 6698 * region-model.cc (region_model::on_call_pre): Always set conjured 6699 LHS, not just for SSA names. 6700 6701 2021-07-23 David Malcolm <dmalcolm (a] redhat.com> 6702 6703 * diagnostic-manager.cc 6704 (class auto_disable_complexity_checks): New. 6705 (epath_finder::explore_feasible_paths): Use it to disable 6706 complexity checks whilst processing the worklist. 6707 * region-model-manager.cc 6708 (region_model_manager::region_model_manager): Initialize 6709 m_check_complexity. 6710 (region_model_manager::reject_if_too_complex): Bail if 6711 m_check_complexity is false. 6712 * region-model.h 6713 (region_model_manager::enable_complexity_check): New. 6714 (region_model_manager::disable_complexity_check): New. 6715 (region_model_manager::m_check_complexity): New. 6716 6717 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6718 6719 PR analyzer/101547 6720 * sm-file.cc (file_leak::emit): Handle m_arg being NULL. 6721 (file_leak::describe_final_event): Handle ev.m_expr being NULL. 6722 6723 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6724 6725 PR analyzer/101522 6726 * store.cc (binding_cluster::purge_state_involving): Don't change 6727 m_map whilst iterating through it. 6728 6729 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6730 6731 * region-model.cc (region_model::handle_phi): Add "old_state" 6732 param and use it. 6733 (region_model::update_for_phis): Update so that all of the phi 6734 stmts are effectively handled simultaneously, rather than in 6735 order. 6736 * region-model.h (region_model::handle_phi): Add "old_state" 6737 param. 6738 * state-purge.cc (self_referential_phi_p): Replace with... 6739 (name_used_by_phis_p): ...this new function. 6740 (state_purge_per_ssa_name::process_point): Update to use the 6741 above, so that all phi stmts at a basic block are effectively 6742 considered simultaneously, and only consider the phi arguments for 6743 the pertinent in-edge. 6744 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New. 6745 (cfg_superedge::get_phi_arg): Use the above. 6746 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl. 6747 6748 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6749 6750 * state-purge.cc (state_purge_annotator::add_node_annotations): 6751 Rather than erroneously always using the NULL in-edge, determine 6752 each relevant in-edge, and print the appropriate data for each 6753 in-edge. Use print_needed to print the data as comma-separated 6754 lists of SSA names. 6755 (print_vec_of_names): Add "within_table" param and use it. 6756 (state_purge_annotator::add_stmt_annotations): Factor out 6757 collation and printing code into... 6758 (state_purge_annotator::print_needed): ...this new function. 6759 * state-purge.h (state_purge_annotator::print_needed): New decl. 6760 6761 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6762 6763 * program-point.cc (function_point::print): Show src BB index at 6764 BEFORE_SUPERNODE. 6765 6766 2021-07-21 David Malcolm <dmalcolm (a] redhat.com> 6767 6768 * svalue.cc (infix_p): New. 6769 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR 6770 in prefix form, rather than infix. 6771 6772 2021-07-19 David Malcolm <dmalcolm (a] redhat.com> 6773 6774 PR analyzer/101503 6775 * constraint-manager.cc (constraint_manager::add_constraint): Use 6776 can_have_associated_state_p rather than testing for unknown. 6777 (constraint_manager::get_or_add_equiv_class): Likewise. 6778 * program-state.cc (sm_state_map::set_state): Likewise. 6779 (sm_state_map::impl_set_state): Add assertion. 6780 * region-model-manager.cc 6781 (region_model_manager::maybe_fold_unaryop): Handle poisoned 6782 values. 6783 (region_model_manager::maybe_fold_binop): Move handling of unknown 6784 values... 6785 (region_model_manager::get_or_create_binop): ...to here, and 6786 generalize to use can_have_associated_state_p. 6787 (region_model_manager::maybe_fold_sub_svalue): Use 6788 can_have_associated_state_p rather than testing for unknown. 6789 (region_model_manager::maybe_fold_repeated_svalue): Use unknown 6790 when the size or repeated value is "unknown"/"poisoned". 6791 * region-model.cc (region_model::purge_state_involving): Reject 6792 attempts to purge unknown/poisoned svalues, as these svalues 6793 should not have state associated with them. 6794 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building 6795 on top of an svalue with can_have_associated_state_p. 6796 (repeated_svalue::repeated_svalue): Likewise. 6797 (bits_within_svalue::bits_within_svalue): Likewise. 6798 * svalue.h (svalue::can_have_associated_state_p): New. 6799 (unknown_svalue::can_have_associated_state_p): New. 6800 (poisoned_svalue::can_have_associated_state_p): New. 6801 (unaryop_svalue::unaryop_svalue): Assert that we're building on 6802 top of an svalue with can_have_associated_state_p. 6803 (binop_svalue::binop_svalue): Likewise. 6804 (widening_svalue::widening_svalue): Likewise. 6805 6806 2021-07-16 David Malcolm <dmalcolm (a] redhat.com> 6807 6808 * analyzer.h (enum access_direction): New. 6809 * engine.cc (exploded_node::on_longjmp): Update for new param of 6810 get_store_value. 6811 * program-state.cc (program_state::prune_for_point): Likewise. 6812 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 6813 Replace call to check_for_writable_region with call to 6814 check_region_for_write. 6815 (region_model::impl_call_memset): Likewise. 6816 (region_model::impl_call_strcpy): Likewise. 6817 * region-model-reachability.cc (reachable_regions::add): Update 6818 for new param of get_store_value. 6819 * region-model.cc (region_model::get_rvalue_1): Likewise, also for 6820 get_rvalue_for_bits. 6821 (region_model::get_store_value): Add ctxt param and use it to call 6822 check_region_for_read. 6823 (region_model::get_rvalue_for_bits): Add ctxt param and use it to 6824 call get_store_value. 6825 (region_model::check_region_access): New. 6826 (region_model::check_region_for_write): New. 6827 (region_model::check_region_for_read): New. 6828 (region_model::set_value): Update comment. Replace call to 6829 check_for_writable_region with call to check_region_for_write. 6830 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt 6831 param. 6832 (region_model::get_store_value): Add ctxt param. 6833 (region_model::check_region_access): New decl. 6834 (region_model::check_region_for_write): New decl. 6835 (region_model::check_region_for_read): New decl. 6836 * region.cc (region_model::copy_region): Update call to 6837 get_store_value. 6838 * svalue.cc (initial_svalue::implicitly_live_p): Likewise. 6839 6840 2021-07-16 David Malcolm <dmalcolm (a] redhat.com> 6841 6842 * engine.cc (exploded_node::on_stmt_pre): Handle 6843 __analyzer_dump_state. 6844 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New. 6845 (program_state::impl_call_analyzer_dump_state): New. 6846 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl. 6847 (program_state::impl_call_analyzer_dump_state): New decl. 6848 * region-model-impl-calls.cc 6849 (call_details::get_arg_string_literal): New. 6850 * region-model.h (call_details::get_arg_string_literal): New decl. 6851 6852 2021-07-16 David Malcolm <dmalcolm (a] redhat.com> 6853 6854 * program-state.cc (program_state::detect_leaks): Simplify using 6855 svalue::maybe_get_region. 6856 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise. 6857 (region_model::impl_call_fread): Likewise. 6858 (region_model::impl_call_free): Likewise. 6859 (region_model::impl_call_operator_delete): Likewise. 6860 * region-model.cc (selftest::test_stack_frames): Likewise. 6861 (selftest::test_state_merging): Likewise. 6862 * svalue.cc (svalue::maybe_get_region): New. 6863 * svalue.h (svalue::maybe_get_region): New decl. 6864 6865 2021-07-15 David Malcolm <dmalcolm (a] redhat.com> 6866 6867 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make 6868 param and template param const. 6869 (is_a_helper <widening_svalue *>::test): Likewise. 6870 (is_a_helper <compound_svalue *>::test): Likewise. 6871 (is_a_helper <conjured_svalue *>::test): Likewise. 6872 6873 2021-07-15 David Malcolm <dmalcolm (a] redhat.com> 6874 6875 PR analyzer/95006 6876 PR analyzer/94713 6877 PR analyzer/94714 6878 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out 6879 GIMPLE_ASSIGN case into... 6880 (get_diagnostic_tree_for_gassign_1): New. 6881 (get_diagnostic_tree_for_gassign): New. 6882 * analyzer.h (get_diagnostic_tree_for_gassign): New decl. 6883 * analyzer.opt (Wanalyzer-write-to-string-literal): New. 6884 * constraint-manager.cc (class svalue_purger): New. 6885 (constraint_manager::purge_state_involving): New. 6886 * constraint-manager.h 6887 (constraint_manager::purge_state_involving): New. 6888 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New. 6889 (dedupe_winners::handle_interactions): New. 6890 (diagnostic_manager::emit_saved_diagnostics): Call it. 6891 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl. 6892 * engine.cc (impl_region_model_context::warn): Convert return type 6893 to bool. Return false if the diagnostic isn't saved. 6894 (impl_region_model_context::purge_state_involving): New. 6895 (impl_sm_context::get_state): Use NULL ctxt when querying old 6896 rvalue. 6897 (impl_sm_context::set_next_state): Use new sval when querying old 6898 state. 6899 (class dump_path_diagnostic): Move to region-model.cc 6900 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post. 6901 Remove call to purge_state_involving. 6902 (exploded_node::on_stmt_pre): New, based on the above. Move most 6903 of it to region_model::on_stmt_pre. 6904 (exploded_node::on_stmt_post): Likewise, moving to 6905 region_model::on_stmt_post. 6906 (class stale_jmp_buf): Fix parent class to use curiously recurring 6907 template pattern. 6908 (feasibility_state::maybe_update_for_edge): Call on_call_pre and 6909 on_call_post on gcalls. 6910 * exploded-graph.h (impl_region_model_context::warn): Return bool. 6911 (impl_region_model_context::purge_state_involving): New decl. 6912 (exploded_node::on_stmt_pre): New decl. 6913 (exploded_node::on_stmt_post): New decl. 6914 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New. 6915 (pending_diagnostic::supercedes_p): New. 6916 * program-state.cc (sm_state_map::get_state): Inherit state for 6917 conjured_svalue as well as initial_svalue. 6918 (sm_state_map::purge_state_involving): Also support SK_CONJURED. 6919 * region-model-impl-calls.cc (call_details::get_uncertainty): 6920 Handle m_ctxt being NULL. 6921 (call_details::get_or_create_conjured_svalue): New. 6922 (region_model::impl_call_fgets): New. 6923 (region_model::impl_call_fread): New. 6924 * region-model-manager.cc 6925 (region_model_manager::get_or_create_initial_value): Return an 6926 uninitialized poisoned value for regions that can't have initial 6927 values. 6928 * region-model-reachability.cc 6929 (reachable_regions::mark_escaped_clusters): Handle ctxt being 6930 NULL. 6931 * region-model.cc (region_to_value_map::purge_state_involving): New. 6932 (poisoned_value_diagnostic::use_of_uninit_p): New. 6933 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT. 6934 (poisoned_value_diagnostic::describe_final_event): Likewise. 6935 (region_model::check_for_poison): New. 6936 (region_model::on_assignment): Call it. 6937 (class dump_path_diagnostic): Move here from engine.cc. 6938 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt. 6939 (region_model::on_call_pre): Move the setting of the LHS to a 6940 conjured svalue to before the checks for specific functions. 6941 Handle "fgets", "fgets_unlocked", and "fread". 6942 (region_model::purge_state_involving): New. 6943 (region_model::handle_unrecognized_call): Handle ctxt being NULL. 6944 (region_model::get_rvalue): Call check_for_poison. 6945 (selftest::test_stack_frames): Use NULL for context when getting 6946 uninitialized rvalue. 6947 (selftest::test_alloca): Likewise. 6948 * region-model.h (region_to_value_map::purge_state_involving): New 6949 decl. 6950 (call_details::get_or_create_conjured_svalue): New decl. 6951 (region_model::on_stmt_pre): New decl. 6952 (region_model::purge_state_involving): New decl. 6953 (region_model::impl_call_fgets): New decl. 6954 (region_model::impl_call_fread): New decl. 6955 (region_model::check_for_poison): New decl. 6956 (region_model_context::warn): Return bool. 6957 (region_model_context::purge_state_involving): New. 6958 (noop_region_model_context::warn): Return bool. 6959 (noop_region_model_context::purge_state_involving): New. 6960 (test_region_model_context:: warn): Return bool. 6961 * region.cc (region::get_memory_space): New. 6962 (region::can_have_initial_svalue_p): New. 6963 (region::involves_p): New. 6964 * region.h (enum memory_space): New. 6965 (region::get_memory_space): New decl. 6966 (region::can_have_initial_svalue_p): New decl. 6967 (region::involves_p): New decl. 6968 * sm-malloc.cc (use_after_free::supercedes_p): New. 6969 * store.cc (binding_cluster::purge_state_involving): New. 6970 (store::purge_state_involving): New. 6971 * store.h (class symbolic_binding): New forward decl. 6972 (binding_key::dyn_cast_symbolic_binding): New. 6973 (symbolic_binding::dyn_cast_symbolic_binding): New. 6974 (binding_cluster::purge_state_involving): New. 6975 (store::purge_state_involving): New. 6976 * svalue.cc (svalue::can_merge_p): Reject attempts to merge 6977 poisoned svalues with other svalues, so that we identify 6978 paths in which a variable is conditionally uninitialized. 6979 (involvement_visitor::visit_conjured_svalue): New. 6980 (svalue::involves_p): Also handle SK_CONJURED. 6981 (poison_kind_to_str): Handle POISON_KIND_UNINIT. 6982 (poisoned_svalue::maybe_fold_bits_within): New. 6983 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT. 6984 (poisoned_svalue::maybe_fold_bits_within): New decl. 6985 6986 2021-07-15 David Malcolm <dmalcolm (a] redhat.com> 6987 6988 * analyzer.opt (fdump-analyzer-exploded-paths): New. 6989 * diagnostic-manager.cc 6990 (diagnostic_manager::emit_saved_diagnostic): Implement it. 6991 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and 6992 use it to dump states if non-NULL. 6993 (exploded_path::dump): Likewise. 6994 (exploded_path::dump_to_file): New. 6995 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state 6996 param. 6997 (exploded_path::dump): Likewise. 6998 (exploded_path::dump): Likewise. 6999 (exploded_path::dump_to_file): New. 7000 7001 2021-07-15 David Malcolm <dmalcolm (a] redhat.com> 7002 7003 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR 7004 if it's available. 7005 * engine.cc (readability): Likewise. 7006 7007 2021-07-15 David Malcolm <dmalcolm (a] redhat.com> 7008 7009 * state-purge.cc (self_referential_phi_p): New. 7010 (state_purge_per_ssa_name::process_point): Don't purge an SSA name 7011 at its def-stmt if the def-stmt is self-referential. 7012 7013 2021-07-07 David Malcolm <dmalcolm (a] redhat.com> 7014 7015 * diagnostic-manager.cc (null_assignment_sm_context::get_state): 7016 New overload. 7017 (null_assignment_sm_context::set_next_state): New overload. 7018 (null_assignment_sm_context::get_diagnostic_tree): New. 7019 * engine.cc (impl_sm_context::get_state): New overload. 7020 (impl_sm_context::set_next_state): New overload. 7021 (impl_sm_context::get_diagnostic_tree): New overload. 7022 (impl_region_model_context::on_condition): Convert params from 7023 tree to const svalue *. 7024 * exploded-graph.h (impl_region_model_context::on_condition): 7025 Likewise. 7026 * region-model.cc (region_model::on_call_pre): Move handling of 7027 internal calls to before checking for get_fndecl_for_call. 7028 (region_model::add_constraints_from_binop): New. 7029 (region_model::add_constraint): Split out into a new overload 7030 working on const svalue * rather than tree. Call 7031 add_constraints_from_binop. Drop call to 7032 add_any_constraints_from_ssa_def_stmt. 7033 (region_model::add_any_constraints_from_ssa_def_stmt): Delete. 7034 (region_model::add_any_constraints_from_gassign): Delete. 7035 (region_model::add_any_constraints_from_gcall): Delete. 7036 * region-model.h 7037 (region_model::add_any_constraints_from_ssa_def_stmt): Delete. 7038 (region_model::add_any_constraints_from_gassign): Delete. 7039 (region_model::add_any_constraints_from_gcall): Delete. 7040 (region_model::add_constraint): Add overload decl. 7041 (region_model::add_constraints_from_binop): New decl. 7042 (region_model_context::on_condition): Convert params from tree to 7043 const svalue *. 7044 (noop_region_model_context::on_condition): Likewise. 7045 * sm-file.cc (fileptr_state_machine::condition): Likewise. 7046 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise. 7047 * sm-pattern-test.cc: Include tristate.h, selftest.h, 7048 analyzer/call-string.h, analyzer/program-point.h, 7049 analyzer/store.h, and analyzer/region-model.h. 7050 (pattern_test_state_machine::on_condition): Convert params from tree to 7051 const svalue *. 7052 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete. 7053 * sm-signal.cc (signal_state_machine::on_condition): Delete. 7054 * sm-taint.cc (taint_state_machine::on_condition): Convert params 7055 from tree to const svalue *. 7056 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h, 7057 analyzer/program-point.h, analyzer/store.h, and 7058 analyzer/region-model.h. 7059 (any_pointer_p): Add overload taking const svalue *sval. 7060 * sm.h (any_pointer_p): Add overload taking const svalue *sval. 7061 (state_machine::on_condition): Convert params from tree to 7062 const svalue *. Provide no-op default implementation. 7063 (sm_context::get_state): Add overload taking const svalue *sval. 7064 (sm_context::set_next_state): Likewise. 7065 (sm_context::on_transition): Likewise. 7066 (sm_context::get_diagnostic_tree): Likewise. 7067 * svalue.cc (svalue::all_zeroes_p): New. 7068 (constant_svalue::all_zeroes_p): New. 7069 (repeated_svalue::all_zeroes_p): Convert to vfunc. 7070 * svalue.h (svalue::all_zeroes_p): New decl. 7071 (constant_svalue::all_zeroes_p): New decl. 7072 (repeated_svalue::all_zeroes_p): Convert decl to vfunc. 7073 7074 2021-06-30 David Malcolm <dmalcolm (a] redhat.com> 7075 7076 PR analyzer/95006 7077 * analyzer.h (class repeated_svalue): New forward decl. 7078 (class bits_within_svalue): New forward decl. 7079 (class sized_region): New forward decl. 7080 (get_field_at_bit_offset): New forward decl. 7081 * engine.cc (exploded_graph::get_or_create_node): Validate the 7082 merged state. 7083 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 7084 Validate the states at each stage. 7085 * program-state.cc (program_state::validate): Validate 7086 m_region_model. 7087 * region-model-impl-calls.cc (region_model::impl_call_memset): 7088 Replace special-case logic for handling constant sizes with 7089 a call to fill_region of a sized_region with the given fill value. 7090 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): 7091 Drop DK_direct. 7092 (region_model_manager::maybe_fold_sub_svalue): Fold element-based 7093 subregions of an initial value into initial values of an element. 7094 Fold subvalues of repeated svalues. 7095 (region_model_manager::maybe_fold_repeated_svalue): New. 7096 (region_model_manager::get_or_create_repeated_svalue): New. 7097 (get_bit_range_for_field): New. 7098 (get_byte_range_for_field): New. 7099 (get_field_at_byte_range): New. 7100 (region_model_manager::maybe_fold_bits_within_svalue): New. 7101 (region_model_manager::get_or_create_bits_within): New. 7102 (region_model_manager::get_sized_region): New. 7103 (region_model_manager::log_stats): Update for addition of 7104 m_repeated_values_map, m_bits_within_values_map, and 7105 m_sized_regions. 7106 * region-model.cc (region_model::validate): New. 7107 (region_model::on_assignment): Drop enum binding_kind. 7108 (region_model::get_initial_value_for_global): Likewise. 7109 (region_model::get_rvalue_for_bits): Replace body with call to 7110 get_or_create_bits_within. 7111 (region_model::get_capacity): Handle RK_SIZED. 7112 (region_model::set_value): Drop enum binding_kind. 7113 (region_model::fill_region): New. 7114 (region_model::get_representative_path_var_1): Handle RK_SIZED. 7115 * region-model.h (visitor::visit_repeated_svalue): New. 7116 (visitor::visit_bits_within_svalue): New. 7117 (region_model_manager::get_or_create_repeated_svalue): New decl. 7118 (region_model_manager::get_or_create_bits_within): New decl. 7119 (region_model_manager::get_sized_region): New decl. 7120 (region_model_manager::maybe_fold_repeated_svalue): New decl. 7121 (region_model_manager::maybe_fold_bits_within_svalue): New decl. 7122 (region_model_manager::repeated_values_map_t): New typedef. 7123 (region_model_manager::m_repeated_values_map): New field. 7124 (region_model_manager::bits_within_values_map_t): New typedef. 7125 (region_model_manager::m_bits_within_values_map): New field. 7126 (region_model_manager::m_sized_regions): New field. 7127 (region_model::fill_region): New decl. 7128 * region.cc (region::get_base_region): Handle RK_SIZED. 7129 (region::base_region_p): Likewise. 7130 (region::get_byte_size_sval): New. 7131 (get_field_at_bit_offset): Make non-static. 7132 (region::calc_offset): Move implementation of cases to 7133 get_relative_concrete_offset vfunc implementations. Handle 7134 RK_SIZED. 7135 (region::get_relative_concrete_offset): New. 7136 (decl_region::get_svalue_for_initializer): Drop enum binding_kind. 7137 (field_region::get_relative_concrete_offset): New, from 7138 region::calc_offset. 7139 (element_region::get_relative_concrete_offset): Likewise. 7140 (offset_region::get_relative_concrete_offset): Likewise. 7141 (sized_region::accept): New. 7142 (sized_region::dump_to_pp): New. 7143 (sized_region::get_byte_size): New. 7144 (sized_region::get_bit_size): New. 7145 * region.h (enum region_kind): Add RK_SIZED. 7146 (region::dyn_cast_sized_region): New. 7147 (region::get_byte_size): Make virtual. 7148 (region::get_bit_size): Likewise. 7149 (region::get_byte_size_sval): New decl. 7150 (region::get_relative_concrete_offset): New decl. 7151 (field_region::get_relative_concrete_offset): New decl. 7152 (element_region::get_relative_concrete_offset): Likewise. 7153 (offset_region::get_relative_concrete_offset): Likewise. 7154 (class sized_region): New. 7155 * store.cc (binding_kind_to_string): Delete. 7156 (binding_key::make): Drop enum binding_kind. 7157 (binding_key::dump_to_pp): Delete. 7158 (binding_key::cmp_ptrs): Drop enum binding_kind. 7159 (bit_range::contains_p): New. 7160 (byte_range::dump): New. 7161 (byte_range::contains_p): New. 7162 (byte_range::cmp): New. 7163 (concrete_binding::dump_to_pp): Drop enum binding_kind. 7164 (concrete_binding::cmp_ptr_ptr): Likewise. 7165 (symbolic_binding::dump_to_pp): Likewise. 7166 (symbolic_binding::cmp_ptr_ptr): Likewise. 7167 (binding_map::apply_ctor_val_to_range): Likewise. 7168 (binding_map::apply_ctor_pair_to_child_region): Likewise. 7169 (binding_map::get_overlapping_bindings): New. 7170 (binding_map::remove_overlapping_bindings): New. 7171 (binding_cluster::validate): New. 7172 (binding_cluster::bind): Drop enum binding_kind. 7173 (binding_cluster::bind_compound_sval): Likewise. 7174 (binding_cluster::purge_region): Likewise. 7175 (binding_cluster::zero_fill_region): Reimplement in terms of... 7176 (binding_cluster::fill_region): New. 7177 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind. 7178 (binding_cluster::get_binding): Likewise. 7179 (binding_cluster::get_binding_recursive): Likewise. 7180 (binding_cluster::get_any_binding): Likewise. 7181 (binding_cluster::maybe_get_compound_binding): Reimplement. 7182 (binding_cluster::get_overlapping_bindings): Delete. 7183 (binding_cluster::remove_overlapping_bindings): Reimplement in 7184 terms of binding_map::remove_overlapping_bindings. 7185 (binding_cluster::can_merge_p): Update for removal of 7186 enum binding_kind. 7187 (binding_cluster::on_unknown_fncall): Drop enum binding_kind. 7188 (binding_cluster::maybe_get_simple_value): Likewise. 7189 (store_manager::get_concrete_binding): Likewise. 7190 (store_manager::get_symbolic_binding): Likewise. 7191 (store::validate): New. 7192 (store::set_value): Drop enum binding_kind. 7193 (store::zero_fill_region): Reimplement in terms of... 7194 (store::fill_region): New. 7195 (selftest::test_binding_key_overlap): Drop enum binding_kind. 7196 * store.h (enum binding_kind): Delete. 7197 (binding_kind_to_string): Delete decl. 7198 (binding_key::make): Drop enum binding_kind. 7199 (binding_key::dump_to_pp): Make pure virtual. 7200 (binding_key::get_kind): Delete. 7201 (binding_key::mark_deleted): Delete. 7202 (binding_key::mark_empty): Delete. 7203 (binding_key::is_deleted): Delete. 7204 (binding_key::is_empty): Delete. 7205 (binding_key::binding_key): Delete. 7206 (binding_key::impl_hash): Delete. 7207 (binding_key::impl_eq): Delete. 7208 (binding_key::m_kind): Delete. 7209 (bit_range::get_last_bit_offset): New. 7210 (bit_range::contains_p): New. 7211 (byte_range::contains_p): New. 7212 (byte_range::operator==): New. 7213 (byte_range::get_start_byte_offset): New. 7214 (byte_range::get_next_byte_offset): New. 7215 (byte_range::get_last_byte_offset): New. 7216 (byte_range::as_bit_range): New. 7217 (byte_range::cmp): New. 7218 (concrete_binding::concrete_binding): Drop enum binding_kind. 7219 (concrete_binding::hash): Likewise. 7220 (concrete_binding::operator==): Likewise. 7221 (concrete_binding::mark_deleted): New. 7222 (concrete_binding::mark_empty): New. 7223 (concrete_binding::is_deleted): New. 7224 (concrete_binding::is_empty): New. 7225 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false. 7226 (symbolic_binding::symbolic_binding): Drop enum binding_kind. 7227 (symbolic_binding::hash): Likewise. 7228 (symbolic_binding::operator==): Likewise. 7229 (symbolic_binding::mark_deleted): New. 7230 (symbolic_binding::mark_empty): New. 7231 (symbolic_binding::is_deleted): New. 7232 (symbolic_binding::is_empty): New. 7233 (binding_map::remove_overlapping_bindings): New decl. 7234 (binding_map::get_overlapping_bindings): New decl. 7235 (binding_cluster::validate): New decl. 7236 (binding_cluster::bind): Drop enum binding_kind. 7237 (binding_cluster::fill_region): New decl. 7238 (binding_cluster::get_binding): Drop enum binding_kind. 7239 (binding_cluster::get_binding_recursive): Likewise. 7240 (binding_cluster::get_overlapping_bindings): Delete. 7241 (store::validate): New decl. 7242 (store::set_value): Drop enum binding_kind. 7243 (store::fill_region): New decl. 7244 (store_manager::get_concrete_binding): Drop enum binding_kind. 7245 (store_manager::get_symbolic_binding): Likewise. 7246 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and 7247 SK_BITS_WITHIN. 7248 (svalue::extract_bit_range): New. 7249 (svalue::maybe_fold_bits_within): New. 7250 (constant_svalue::maybe_fold_bits_within): New. 7251 (unknown_svalue::maybe_fold_bits_within): New. 7252 (unaryop_svalue::maybe_fold_bits_within): New. 7253 (repeated_svalue::repeated_svalue): New. 7254 (repeated_svalue::dump_to_pp): New. 7255 (repeated_svalue::accept): New. 7256 (repeated_svalue::all_zeroes_p): New. 7257 (repeated_svalue::maybe_fold_bits_within): New. 7258 (bits_within_svalue::bits_within_svalue): New. 7259 (bits_within_svalue::dump_to_pp): New. 7260 (bits_within_svalue::maybe_fold_bits_within): New. 7261 (bits_within_svalue::accept): New. 7262 (bits_within_svalue::implicitly_live_p): New. 7263 (compound_svalue::maybe_fold_bits_within): New. 7264 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN. 7265 (svalue::dyn_cast_repeated_svalue): New. 7266 (svalue::dyn_cast_bits_within_svalue): New. 7267 (svalue::extract_bit_range): New decl. 7268 (svalue::maybe_fold_bits_within): New vfunc decl. 7269 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7270 (region_svalue::key_t::is_empty): Likewise. 7271 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false. 7272 (constant_svalue::maybe_fold_bits_within): New. 7273 (unknown_svalue::maybe_fold_bits_within): New. 7274 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7275 (poisoned_svalue::key_t::is_empty): Likewise. 7276 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make 7277 false. 7278 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7279 (setjmp_svalue::key_t::is_empty): Likewise. 7280 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make 7281 false. 7282 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7283 (unaryop_svalue::key_t::is_empty): Likewise. 7284 (unaryop_svalue::maybe_fold_bits_within): New. 7285 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make 7286 false. 7287 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7288 (binop_svalue::key_t::is_empty): Likewise. 7289 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make 7290 false. 7291 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7292 (sub_svalue::key_t::is_empty): Likewise. 7293 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make 7294 false. 7295 (class repeated_svalue): New. 7296 (is_a_helper <const repeated_svalue *>::test): New. 7297 (struct default_hash_traits<repeated_svalue::key_t>): New. 7298 (class bits_within_svalue): New. 7299 (is_a_helper <const bits_within_svalue *>::test): New. 7300 (struct default_hash_traits<bits_within_svalue::key_t>): New. 7301 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7302 (widening_svalue::key_t::is_empty): Likewise. 7303 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make 7304 false. 7305 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE. 7306 (compound_svalue::key_t::is_empty): Likewise. 7307 (compound_svalue::maybe_fold_bits_within): New. 7308 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make 7309 false. 7310 7311 2021-06-28 David Malcolm <dmalcolm (a] redhat.com> 7312 7313 * analyzer.h (byte_offset_t): New typedef. 7314 * store.cc (bit_range::dump_to_pp): Dump as a byte range if 7315 possible. 7316 (bit_range::as_byte_range): New. 7317 (byte_range::dump_to_pp): New. 7318 * store.h (class byte_range): New forward decl. 7319 (struct bit_range): Add comment. 7320 (bit_range::as_byte_range): New decl. 7321 (struct byte_range): New. 7322 7323 2021-06-22 David Malcolm <dmalcolm (a] redhat.com> 7324 7325 PR analyzer/101143 7326 * region-model.cc (compat_types_p): New function. 7327 (region_model::create_region_for_heap_alloc): Convert assertion to 7328 an error check. 7329 (region_model::create_region_for_alloca): Likewise. 7330 7331 2021-06-18 David Malcolm <dmalcolm (a] redhat.com> 7332 7333 * store.cc (binding_cluster::get_any_binding): Make symbolic reads 7334 from a cluster with concrete bindings return unknown. 7335 7336 2021-06-18 David Malcolm <dmalcolm (a] redhat.com> 7337 7338 * region-model-manager.cc 7339 (region_model_manager::get_or_create_int_cst): New. 7340 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use 7341 it to simplify away a local tree. 7342 * region-model.cc (region_model::on_setjmp): Likewise. 7343 (region_model::on_longjmp): Likewise. 7344 * region-model.h (region_model_manager::get_or_create_int_cst): 7345 New decl. 7346 * store.cc (binding_cluster::zero_fill_region): Use it to simplify 7347 away a local tree. 7348 7349 2021-06-18 David Malcolm <dmalcolm (a] redhat.com> 7350 7351 * checker-path.cc (class custom_event): Make abstract to allow for 7352 custom vfuncs, splitting existing implementation into... 7353 (class precanned_custom_event): New subclass. 7354 (custom_event::get_desc): Move to... 7355 (precanned_custom_event::get_desc): ...subclass. 7356 * checker-path.h (class custom_event): Make abstract to allow for 7357 custom vfuncs, splitting existing implementation into... 7358 (class precanned_custom_event): New subclass. 7359 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge): 7360 Use precanned_custom_event. 7361 * engine.cc 7362 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise. 7363 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path): 7364 Likewise. 7365 7366 2021-06-15 David Malcolm <dmalcolm (a] redhat.com> 7367 7368 PR analyzer/99212 7369 PR analyzer/101082 7370 * engine.cc: Include "target.h". 7371 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and 7372 WORDS_BIG_ENDIAN. 7373 * region-model-manager.cc 7374 (region_model_manager::maybe_fold_binop): Move support for masking 7375 via ARG0 & CST into... 7376 (region_model_manager::maybe_undo_optimize_bit_field_compare): 7377 ...this new function. Flatten by converting from nested 7378 conditionals to a series of early return statements to reject 7379 failures. Reject if type is not unsigned_char_type_node. 7380 Handle BYTES_BIG_ENDIAN when determining which bits are bound 7381 in the binding_map. 7382 * region-model.h 7383 (region_model_manager::maybe_undo_optimize_bit_field_compare): 7384 New decl. 7385 * store.cc (bit_range::dump): New function. 7386 * store.h (bit_range::dump): New decl. 7387 7388 2021-06-15 David Malcolm <dmalcolm (a] redhat.com> 7389 7390 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity. 7391 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags. 7392 (state_change_requires_new_enode_p): New function... 7393 (exploded_graph::process_node): Call it, rather than querying 7394 flags.m_sm_changes, so that dynamic-extent differences can also 7395 trigger the splitting of nodes. 7396 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes. 7397 * program-state.cc (program_state::detect_leaks): Purge dead 7398 heap-allocated regions from dynamic extents. 7399 (selftest::test_program_state_1): Fix type of "size_in_bytes". 7400 (selftest::test_program_state_merging): Likewise. 7401 * region-model-impl-calls.cc 7402 (region_model::impl_call_analyzer_dump_capacity): New. 7403 (region_model::impl_call_free): Remove dynamic extents from the 7404 freed region. 7405 * region-model-reachability.h 7406 (reachable_regions::begin_mutable_base_regs): New. 7407 (reachable_regions::end_mutable_base_regs): New. 7408 * region-model.cc: Include "tree-object-size.h". 7409 (region_model::region_model): Support new field m_dynamic_extents. 7410 (region_model::operator=): Likewise. 7411 (region_model::operator==): Likewise. 7412 (region_model::dump_to_pp): Dump sizes of dynamic regions. 7413 (region_model::handle_unrecognized_call): Purge dynamic extents 7414 from any regions that have escaped mutably:. 7415 (region_model::get_capacity): New function. 7416 (region_model::add_constraint): Unset dynamic extents when a 7417 heap-allocated region's address is NULL. 7418 (region_model::unbind_region_and_descendents): Purge dynamic 7419 extents of unbound regions. 7420 (region_model::can_merge_with_p): Call 7421 m_dynamic_extents.can_merge_with_p. 7422 (region_model::create_region_for_heap_alloc): Assert that 7423 size_in_bytes's type is compatible with size_type_node. Update 7424 for renaming of record_dynamic_extents to set_dynamic_extents. 7425 (region_model::create_region_for_alloca): Likewise. 7426 (region_model::record_dynamic_extents): Rename to... 7427 (region_model::set_dynamic_extents): ...this. Assert that 7428 size_in_bytes's type is compatible with size_type_node. Add it 7429 to the m_dynamic_extents map. 7430 (region_model::get_dynamic_extents): New. 7431 (region_model::unset_dynamic_extents): New. 7432 (selftest::test_state_merging): Fix type of "size". 7433 (selftest::test_malloc_constraints): Likewise. 7434 (selftest::test_malloc): Verify dynamic extents. 7435 (selftest::test_alloca): Likewise. 7436 * region-model.h (region_to_value_map::is_empty): New. 7437 (region_model::dynamic_extents_t): New typedef. 7438 (region_model::impl_call_analyzer_dump_capacity): New decl. 7439 (region_model::get_dynamic_extents): New function. 7440 (region_model::get_dynamic_extents): New decl. 7441 (region_model::set_dynamic_extents): New decl. 7442 (region_model::unset_dynamic_extents): New decl. 7443 (region_model::get_capacity): New decl. 7444 (region_model::record_dynamic_extents): Rename to set_dynamic_extents. 7445 (region_model::m_dynamic_extents): New field. 7446 7447 2021-06-15 David Malcolm <dmalcolm (a] redhat.com> 7448 7449 * region-model.cc (region_to_value_map::operator=): New. 7450 (region_to_value_map::operator==): New. 7451 (region_to_value_map::dump_to_pp): New. 7452 (region_to_value_map::dump): New. 7453 (region_to_value_map::can_merge_with_p): New. 7454 * region-model.h (class region_to_value_map): New class. 7455 7456 2021-06-13 Trevor Saunders <tbsaunde (a] tbsaunde.org> 7457 7458 * call-string.cc (call_string::call_string): Use range based for 7459 to iterate over vec<>. 7460 (call_string::to_json): Likewise. 7461 (call_string::hash): Likewise. 7462 (call_string::calc_recursion_depth): Likewise. 7463 * checker-path.cc (checker_path::fixup_locations): Likewise. 7464 * constraint-manager.cc (equiv_class::equiv_class): Likewise. 7465 (equiv_class::to_json): Likewise. 7466 (equiv_class::hash): Likewise. 7467 (constraint_manager::to_json): Likewise. 7468 * engine.cc (impl_region_model_context::on_svalue_leak): 7469 Likewise. 7470 (on_liveness_change): Likewise. 7471 (impl_region_model_context::on_unknown_change): Likewise. 7472 * program-state.cc (sm_state_map::set_state): Likewise. 7473 * region-model.cc (test_canonicalization_4): Likewise. 7474 7475 2021-06-11 David Malcolm <dmalcolm (a] redhat.com> 7476 7477 * engine.cc (worklist::key_t::cmp): Move sort by call_string to 7478 before SCC. 7479 7480 2021-06-09 David Malcolm <dmalcolm (a] redhat.com> 7481 7482 * region-model.cc (region_model::get_lvalue_1): Make const. 7483 (region_model::get_lvalue): Likewise. 7484 (region_model::get_rvalue_1): Likewise. 7485 (region_model::get_rvalue): Likewise. 7486 (region_model::deref_rvalue): Likewise. 7487 (region_model::get_rvalue_for_bits): Likewise. 7488 * region-model.h (region_model::get_lvalue): Likewise. 7489 (region_model::get_rvalue): Likewise. 7490 (region_model::deref_rvalue): Likewise. 7491 (region_model::get_rvalue_for_bits): Likewise. 7492 (region_model::get_lvalue_1): Likewise. 7493 (region_model::get_rvalue_1): Likewise. 7494 7495 2021-06-08 David Malcolm <dmalcolm (a] redhat.com> 7496 7497 PR analyzer/99212 7498 * region-model-manager.cc 7499 (region_model_manager::maybe_fold_binop): Add support for folding 7500 BIT_AND_EXPR of compound_svalue and a mask constant. 7501 * region-model.cc (region_model::get_rvalue_1): Implement 7502 BIT_FIELD_REF in terms of... 7503 (region_model::get_rvalue_for_bits): New function. 7504 * region-model.h (region_model::get_rvalue_for_bits): New decl. 7505 * store.cc (bit_range::from_mask): New function. 7506 (selftest::test_bit_range_intersects_p): New selftest. 7507 (selftest::assert_bit_range_from_mask_eq): New. 7508 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro. 7509 (selftest::assert_no_bit_range_from_mask_eq): New. 7510 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro. 7511 (selftest::test_bit_range_from_mask): New selftest. 7512 (selftest::analyzer_store_cc_tests): Call the new selftests. 7513 * store.h (bit_range::intersects_p): New. 7514 (bit_range::from_mask): New decl. 7515 (concrete_binding::get_bit_range): New accessor. 7516 (store_manager::get_concrete_binding): New overload taking 7517 const bit_range &. 7518 7519 2021-06-08 David Malcolm <dmalcolm (a] redhat.com> 7520 7521 * analyzer.h (int_size_in_bits): New decl. 7522 * region.cc (int_size_in_bits): New function. 7523 (region::get_bit_size): Reimplement in terms of the above. 7524 7525 2021-06-08 David Malcolm <dmalcolm (a] redhat.com> 7526 7527 * store.cc (concrete_binding::dump_to_pp): Move bulk of 7528 implementation to... 7529 (bit_range::dump_to_pp): ...this new function. 7530 (bit_range::cmp): New. 7531 (concrete_binding::overlaps_p): Update for use of bit_range. 7532 (concrete_binding::cmp_ptr_ptr): Likewise. 7533 * store.h (struct bit_range): New. 7534 (class concrete_binding): Replace fields m_start_bit_offset and 7535 m_size_in_bits with new field m_bit_range. 7536 7537 2021-06-08 David Malcolm <dmalcolm (a] redhat.com> 7538 7539 * svalue.h (conjured_svalue::iterator_t): Delete. 7540 7541 2021-06-03 David Malcolm <dmalcolm (a] redhat.com> 7542 7543 * store.h (store::get_direct_binding): Remove unused decl. 7544 (store::get_default_binding): Likewise. 7545 7546 2021-06-03 David Malcolm <dmalcolm (a] redhat.com> 7547 7548 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type. 7549 (compound_svalue::dump_to_pp): Dump any type. 7550 7551 2021-05-18 David Malcolm <dmalcolm (a] redhat.com> 7552 7553 PR analyzer/100615 7554 * sm-malloc.cc: Include "analyzer/function-set.h". 7555 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and 7556 bail on the functions it recognizes. 7557 (malloc_state_machine::unaffected_by_call_p): New. 7558 7559 2021-05-10 Martin Liska <mliska (a] suse.cz> 7560 7561 * sm-file.cc (is_file_using_fn_p): Use startswith 7562 function instead of strncmp. 7563 7564 2021-05-10 Martin Liska <mliska (a] suse.cz> 7565 7566 * program-state.cc (program_state::operator=): Remove 7567 __cplusplus >= 201103. 7568 (program_state::program_state): Likewise. 7569 * program-state.h: Likewise. 7570 * region-model.h (class region_model): Remove dead code. 7571 7572 2021-04-24 David Malcolm <dmalcolm (a] redhat.com> 7573 7574 PR analyzer/100244 7575 * sm-malloc.cc (free_of_non_heap::describe_state_change): 7576 Bulletproof against change.m_expr being NULL. 7577 7578 2021-04-13 David Malcolm <dmalcolm (a] redhat.com> 7579 7580 PR analyzer/98599 7581 * supergraph.cc (saved_uids::make_uid_unique): New. 7582 (saved_uids::restore_uids): New. 7583 (supergraph::supergraph): Replace assignments to stmt->uid with 7584 calls to m_stmt_uids.make_uid_unique. 7585 (supergraph::~supergraph): New. 7586 * supergraph.h (class saved_uids): New. 7587 (supergraph::~supergraph): New decl. 7588 (supergraph::m_stmt_uids): New field. 7589 7590 2021-04-10 David Malcolm <dmalcolm (a] redhat.com> 7591 7592 PR analyzer/100011 7593 * region-model.cc (region_model::on_assignment): Avoid NULL 7594 dereference if ctxt is NULL when assigning from a STRING_CST. 7595 7596 2021-04-08 David Malcolm <dmalcolm (a] redhat.com> 7597 7598 PR analyzer/99042 7599 PR analyzer/99774 7600 * engine.cc 7601 (impl_region_model_context::impl_region_model_context): Add 7602 uncertainty param and use it to initialize m_uncertainty. 7603 (impl_region_model_context::get_uncertainty): New. 7604 (impl_sm_context::get_fndecl_for_call): Add NULL for new 7605 uncertainty param when constructing impl_region_model_context. 7606 (impl_sm_context::get_state): Likewise. 7607 (impl_sm_context::set_next_state): Likewise. 7608 (impl_sm_context::warn): Likewise. 7609 (exploded_node::on_stmt): Add uncertainty param 7610 and use it when constructing impl_region_model_context. 7611 (exploded_node::on_edge): Add uncertainty param and pass 7612 to on_edge call. 7613 (exploded_node::detect_leaks): Create uncertainty_t and pass to 7614 impl_region_model_context. 7615 (exploded_graph::get_or_create_node): Create uncertainty_t and 7616 pass to prune_for_point. 7617 (maybe_process_run_of_before_supernode_enodes): Create 7618 uncertainty_t and pass to impl_region_model_context. 7619 (exploded_graph::process_node): Create uncertainty_t instances and 7620 pass around as needed. 7621 * exploded-graph.h 7622 (impl_region_model_context::impl_region_model_context): Add 7623 uncertainty param. 7624 (impl_region_model_context::get_uncertainty): New decl. 7625 (impl_region_model_context::m_uncertainty): New field. 7626 (exploded_node::on_stmt): Add uncertainty param. 7627 (exploded_node::on_edge): Likewise. 7628 * program-state.cc (sm_state_map::on_liveness_change): Get 7629 uncertainty from context and use it to unset sm-state from 7630 svalues as appropriate. 7631 (program_state::on_edge): Add uncertainty param and use it when 7632 constructing impl_region_model_context. Fix indentation. 7633 (program_state::prune_for_point): Add uncertainty param and use it 7634 when constructing impl_region_model_context. 7635 (program_state::detect_leaks): Get any uncertainty from ctxt and 7636 use it to get maybe-live svalues for dest_state, rather than 7637 definitely-live ones; use this when determining which svalues 7638 have leaked. 7639 (selftest::test_program_state_merging): Create uncertainty_t and 7640 pass to impl_region_model_context. 7641 * program-state.h (program_state::on_edge): Add uncertainty param. 7642 (program_state::prune_for_point): Likewise. 7643 * region-model-impl-calls.cc (call_details::get_uncertainty): New. 7644 (region_model::impl_call_memcpy): Pass uncertainty to 7645 mark_region_as_unknown call. 7646 (region_model::impl_call_memset): Likewise. 7647 (region_model::impl_call_strcpy): Likewise. 7648 * region-model-reachability.cc (reachable_regions::handle_sval): 7649 Also add sval to m_mutable_svals. 7650 * region-model.cc (region_model::on_assignment): Pass any 7651 uncertainty from ctxt to the store::set_value call. 7652 (region_model::handle_unrecognized_call): Get any uncertainty from 7653 ctxt and use it to record mutable svalues at the unknown call. 7654 (region_model::get_reachable_svalues): Add uncertainty param and 7655 use it to mark any maybe-bound svalues as being reachable. 7656 (region_model::set_value): Pass any uncertainty from ctxt to the 7657 store::set_value call. 7658 (region_model::mark_region_as_unknown): Add uncertainty param and 7659 pass it on to the store::mark_region_as_unknown call. 7660 (region_model::update_for_call_summary): Add uncertainty param and 7661 pass it on to the region_model::mark_region_as_unknown call. 7662 * region-model.h (call_details::get_uncertainty): New decl. 7663 (region_model::get_reachable_svalues): Add uncertainty param. 7664 (region_model::mark_region_as_unknown): Add uncertainty param. 7665 (region_model_context::get_uncertainty): New vfunc. 7666 (noop_region_model_context::get_uncertainty): New vfunc 7667 implementation. 7668 * store.cc (dump_svalue_set): New. 7669 (uncertainty_t::dump_to_pp): New. 7670 (uncertainty_t::dump): New. 7671 (binding_cluster::clobber_region): Pass NULL for uncertainty to 7672 remove_overlapping_bindings. 7673 (binding_cluster::mark_region_as_unknown): Add uncertainty param 7674 and pass it to remove_overlapping_bindings. 7675 (binding_cluster::remove_overlapping_bindings): Add uncertainty param. 7676 Use it to record any svalues that were in clobbered bindings. 7677 (store::set_value): Add uncertainty param. Pass it to 7678 binding_cluster::mark_region_as_unknown when handling symbolic 7679 regions. 7680 (store::mark_region_as_unknown): Add uncertainty param and pass it 7681 to binding_cluster::mark_region_as_unknown. 7682 (store::remove_overlapping_bindings): Add uncertainty param and 7683 pass it to binding_cluster::remove_overlapping_bindings. 7684 * store.h (binding_cluster::mark_region_as_unknown): Add 7685 uncertainty param. 7686 (binding_cluster::remove_overlapping_bindings): Likewise. 7687 (store::set_value): Likewise. 7688 (store::mark_region_as_unknown): Likewise. 7689 7690 2021-04-05 David Malcolm <dmalcolm (a] redhat.com> 7691 7692 PR analyzer/99906 7693 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL 7694 dereference on calls with zero arguments. 7695 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling 7696 __attribute__((nonnull)), only call get_diagnostic_tree if the 7697 result will be used. 7698 7699 2021-04-05 David Malcolm <dmalcolm (a] redhat.com> 7700 7701 PR analyzer/99886 7702 * diagnostic-manager.cc 7703 (diagnostic_manager::prune_interproc_events): Use signed integers 7704 when subtracting one from path->num_events (). 7705 (diagnostic_manager::consolidate_conditions): Likewise. Convert 7706 next_idx to a signed int. 7707 7708 2021-04-01 David Malcolm <dmalcolm (a] redhat.com> 7709 7710 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make 7711 enode param non-constant, and call add_diagnostic on it. Add 7712 enode index to log message. 7713 (diagnostic_manager::add_diagnostic): Make enode param 7714 non-constant. 7715 * diagnostic-manager.h (diagnostic_manager::add_diagnostic): 7716 Likewise for both decls. 7717 * engine.cc 7718 (impl_region_model_context::impl_region_model_context): Likewise 7719 for enode_for_diag. 7720 (impl_sm_context::impl_sm_context): Likewise. 7721 (impl_sm_context::m_enode_for_diag): Likewise. 7722 (exploded_node::dump_dot): Don't pass the diagnostic manager 7723 to dump_saved_diagnostics. 7724 (exploded_node::dump_saved_diagnostics): Drop param. Iterate 7725 directly through all saved diagnostics for the enode, rather 7726 than all saved diagnostics in the diagnostic_manager and 7727 filtering. 7728 (exploded_node::on_stmt): Make non-const. 7729 (exploded_node::on_edge): Likewise. 7730 (exploded_node::on_longjmp): Likewise. 7731 (exploded_node::detect_leaks): Likewise. 7732 (exploded_graph::get_or_create_node): Make enode_for_diag param 7733 non-const. 7734 (exploded_graph_annotator::print_enode): Iterate 7735 directly through all saved diagnostics for the enode, rather 7736 than all saved diagnostics in the diagnostic_manager and 7737 filtering. 7738 * exploded-graph.h 7739 (impl_region_model_context::impl_region_model_context): Make 7740 enode_for_diag param non-constant. 7741 (impl_region_model_context::m_enode_for_diag): Likewise. 7742 (exploded_node::dump_saved_diagnostics): Drop param. 7743 (exploded_node::on_stmt): Make non-const. 7744 (exploded_node::on_edge): Likewise. 7745 (exploded_node::on_longjmp): Likewise. 7746 (exploded_node::detect_leaks): Likewise. 7747 (exploded_node::add_diagnostic): New. 7748 (exploded_node::get_num_diagnostics): New. 7749 (exploded_node::get_saved_diagnostic): New. 7750 (exploded_node::m_saved_diagnostics): New. 7751 (exploded_graph::get_or_create_node): Make enode_for_diag param 7752 non-constant. 7753 * feasible-graph.cc (feasible_node::dump_dot): Drop 7754 diagnostic_manager from call to dump_saved_diagnostics. 7755 * program-state.cc (program_state::on_edge): Convert enode param 7756 to non-const pointer. 7757 (program_state::prune_for_point): Likewise for enode_for_diag 7758 param. 7759 * program-state.h (program_state::on_edge): Convert enode param 7760 to non-const pointer. 7761 (program_state::prune_for_point): Likewise for enode_for_diag 7762 param. 7763 7764 2021-03-31 David Malcolm <dmalcolm (a] redhat.com> 7765 7766 PR analyzer/99771 7767 * analyzer.cc (maybe_reconstruct_from_def_stmt): New. 7768 (fixup_tree_for_diagnostic_1): New. 7769 (fixup_tree_for_diagnostic): New. 7770 * analyzer.h (fixup_tree_for_diagnostic): New decl. 7771 * checker-path.cc (call_event::get_desc): Call 7772 fixup_tree_for_diagnostic and use it for the call_with_state call. 7773 (warning_event::get_desc): Likewise for the final_event and 7774 make_label_text calls. 7775 * engine.cc (impl_region_model_context::on_state_leak): Likewise 7776 for the on_leak and add_diagnostic calls. 7777 * region-model.cc (region_model::get_representative_tree): 7778 Likewise for the result. 7779 7780 2021-03-30 David Malcolm <dmalcolm (a] redhat.com> 7781 7782 * region.h (region::dump_to_pp): Remove old decl. 7783 7784 2021-03-30 David Malcolm <dmalcolm (a] redhat.com> 7785 7786 * sm-file.cc (fileptr_state_machine::on_stmt): Only call 7787 get_diagnostic_tree if the result will be used. 7788 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise. 7789 (malloc_state_machine::on_deallocator_call): Likewise. 7790 (malloc_state_machine::on_realloc_call): Likewise. 7791 (malloc_state_machine::on_realloc_call): Likewise. 7792 * sm-sensitive.cc 7793 (sensitive_state_machine::warn_for_any_exposure): Likewise. 7794 * sm-taint.cc (taint_state_machine::on_stmt): Likewise. 7795 7796 2021-03-25 David Malcolm <dmalcolm (a] redhat.com> 7797 7798 PR analyzer/93695 7799 PR analyzer/99044 7800 PR analyzer/99716 7801 * engine.cc (exploded_node::on_stmt): Clear sm-state involving 7802 an SSA name at the def-stmt of that SSA name. 7803 * program-state.cc (sm_state_map::purge_state_involving): New. 7804 * program-state.h (sm_state_map::purge_state_involving): New decl. 7805 * region-model.cc (selftest::test_involves_p): New. 7806 (selftest::analyzer_region_model_cc_tests): Call it. 7807 * svalue.cc (class involvement_visitor): New class 7808 (svalue::involves_p): New. 7809 * svalue.h (svalue::involves_p): New decl. 7810 7811 2021-03-19 David Malcolm <dmalcolm (a] redhat.com> 7812 7813 PR analyzer/99614 7814 * diagnostic-manager.cc (class epath_finder): Add 7815 DISABLE_COPY_AND_ASSIGN. 7816 7817 2021-03-15 Martin Liska <mliska (a] suse.cz> 7818 7819 * sm-file.cc (get_file_using_fns): Add missing comma in initializer. 7820 7821 2021-03-11 David Malcolm <dmalcolm (a] redhat.com> 7822 7823 PR analyzer/96374 7824 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param. 7825 (fdump-analyzer-feasibility): New flag. 7826 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and 7827 "analyzer/feasible-graph.h". 7828 (epath_finder::epath_finder): Convert m_sep to a pointer and 7829 only create it if !flag_analyzer_feasibility. 7830 (epath_finder::~epath_finder): New. 7831 (epath_finder::m_sep): Convert to a pointer. 7832 (epath_finder::get_best_epath): Add param "diag_idx" and use it 7833 when logging. Rather than finding the shortest path and then 7834 checking feasibility, instead use explore_feasible_paths unless 7835 !flag_analyzer_feasibility, in which case simply use the shortest 7836 path, and note if it is infeasible. Update for m_sep becoming a 7837 pointer. 7838 (class feasible_worklist): New. 7839 (epath_finder::explore_feasible_paths): New. 7840 (epath_finder::process_worklist_item): New. 7841 (class dump_eg_with_shortest_path): New. 7842 (epath_finder::dump_trimmed_graph): New. 7843 (epath_finder::dump_feasible_graph): New. 7844 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it 7845 on new field m_idx. 7846 (saved_diagnostic::to_json): Dump m_idx. 7847 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath. 7848 Remove assertion that m_problem was set when m_best_epath is NULL. 7849 (diagnostic_manager::add_diagnostic): Pass an index when created 7850 saved_diagnostic instances. 7851 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add 7852 "idx" param. 7853 (saved_diagnostic::get_index): New accessor. 7854 (saved_diagnostic::m_idx): New field. 7855 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info. 7856 Move code to... 7857 (exploded_node::dump_processed_stmts): ...this new function and... 7858 (exploded_node::dump_saved_diagnostics): ...this new function. 7859 Add index of each diagnostic. 7860 (exploded_edge::dump_dot): Move bulk of code to... 7861 (exploded_edge::dump_dot_label): ...this new function. 7862 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New 7863 vfunc. 7864 (exploded_node::dump_processed_stmts): New decl. 7865 (exploded_node::dump_saved_diagnostics): New decl. 7866 (exploded_edge::dump_dot_label): New decl. 7867 * feasible-graph.cc: New file. 7868 * feasible-graph.h: New file. 7869 * trimmed-graph.cc: New file. 7870 * trimmed-graph.h: New file. 7871 7872 2021-03-11 David Malcolm <dmalcolm (a] redhat.com> 7873 7874 * diagnostic-manager.cc (epath_finder::epath_finder): 7875 Update shortest_paths init for new param. 7876 7877 2021-03-10 David Malcolm <dmalcolm (a] redhat.com> 7878 7879 PR analyzer/96374 7880 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and 7881 "model" locals into a new class feasibility_state. Move heart 7882 of per-edge processing into 7883 feasibility_state::maybe_update_for_edge. 7884 (feasibility_state::feasibility_state): New. 7885 (feasibility_state::maybe_update_for_edge): New, based on loop 7886 body in exploded_path::feasible_p. 7887 * exploded-graph.h (class feasibility_state): New. 7888 7889 2021-03-10 David Malcolm <dmalcolm (a] redhat.com> 7890 7891 * supergraph.h 7892 (callgraph_superedge::dyn_cast_callgraph_superedge): New. 7893 (call_superedge::dyn_cast_callgraph_superedge): Delete. 7894 (return_superedge::dyn_cast_callgraph_superedge): Delete. 7895 7896 2021-03-02 Martin Liska <mliska (a] suse.cz> 7897 7898 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics): 7899 Do not pass engine. 7900 7901 2021-02-26 David Malcolm <dmalcolm (a] redhat.com> 7902 7903 * engine.cc (exploded_path::exploded_path): New copy-ctor. 7904 * exploded-graph.h (exploded_path::operator=): Drop decl. 7905 7906 2021-02-26 David Malcolm <dmalcolm (a] redhat.com> 7907 7908 PR analyzer/96374 7909 * diagnostic-manager.cc (class epath_finder): New. 7910 (epath_finder::get_best_epath): New. 7911 (saved_diagnostic::saved_diagnostic): Update for replacement of 7912 m_state and m_epath_length with m_best_epath. 7913 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath. 7914 (saved_diagnostic::to_json): Update "path_length" to be optional. 7915 (saved_diagnostic::calc_best_epath): New, based on 7916 dedupe_winners::add and parts of dedupe_key::dedupe_key. 7917 (saved_diagnostic::get_epath_length): New. 7918 (saved_diagnostic::add_duplicate): New. 7919 (dedupe_key::dedupe_key): Drop epath param. Move invocation of 7920 stmt_finder to saved_diagnostic::calc_best_epath. 7921 (class dedupe_candidate): Delete. 7922 (class dedupe_hash_map_traits): Update to use saved_diagnotic * 7923 rather than dedupe_candidate * as the value_type/compare_type. 7924 (dedupe_winners::~dedupe_winners): Don't delete the values. 7925 (dedupe_winners::add): Convert param from shortest_exploded_paths to 7926 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving 7927 path generation and feasiblity checking to 7928 epath_finder::get_best_epath. Update winner-selection for move 7929 of epaths from dedupe_candidate to saved_diagnostic. 7930 (dedupe_winners::emit_best): Update for removal of class 7931 dedupe_candidate. 7932 (dedupe_winners::map_t): Update to use saved_diagnotic * rather 7933 than dedupe_candidate * as the value_type/compare_type. 7934 (diagnostic_manager::emit_saved_diagnostics): Move 7935 shortest_exploded_paths instance into epath_finder and pass that 7936 around instead. 7937 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt 7938 and num_dupes params, instead getting these from the 7939 saved_diagnostic. Use correct location in inform_n call. 7940 * diagnostic-manager.h (class epath_finder): New forward decl. 7941 (saved_diagnostic::status): Drop enum. 7942 (saved_diagnostic::set_feasible): Drop. 7943 (saved_diagnostic::set_infeasible): Drop. 7944 (saved_diagnostic::get_status): Drop. 7945 (saved_diagnostic::calc_best_epath): New decl. 7946 (saved_diagnostic::get_best_epath): New decl. 7947 (saved_diagnostic::get_epath_length): New decl. 7948 (saved_diagnostic::set_epath_length): Drop. 7949 (saved_diagnostic::get_epath_length): Drop inline implementation. 7950 (saved_diagnostic::add_duplicate): New. 7951 (saved_diagnostic::get_num_dupes): New. 7952 (saved_diagnostic::m_d): Document ownership. 7953 (saved_diagnostic::m_trailing_eedge): Make const. 7954 (saved_diagnostic::m_status): Drop field. 7955 (saved_diagnostic::m_epath_length): Drop field. 7956 (saved_diagnostic::m_best_epath): New field. 7957 (saved_diagnostic::m_problem): Document ownership. 7958 (saved_diagnostic::m_duplicates): New field. 7959 (diagnostic_manager::emit_saved_diagnostic): Drop params epath, 7960 stmt, and num_dupes. 7961 * engine.cc (exploded_graph_annotator::print_saved_diagnostic): 7962 Update for changes to saved_diagnostic class. 7963 * exploded-graph.h (exploded_path::feasible_p): Drop unused 7964 overloaded decl. 7965 7966 2021-02-25 David Malcolm <dmalcolm (a] redhat.com> 7967 7968 PR analyzer/99193 7969 * region-model-impl-calls.cc (region_model::impl_call_realloc): New. 7970 * region-model.cc (region_model::on_call_pre): Call it. 7971 * region-model.h (region_model::impl_call_realloc): New decl. 7972 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED. 7973 (malloc_state_machine::m_realloc): New field. 7974 (use_after_free::describe_state_change): Add case for 7975 WORDING_REALLOCATED. 7976 (use_after_free::describe_final_event): Likewise. 7977 (malloc_state_machine::malloc_state_machine): Initialize 7978 m_realloc. 7979 (malloc_state_machine::on_stmt): Handle realloc by calling... 7980 (malloc_state_machine::on_realloc_call): New. 7981 7982 2021-02-22 David Malcolm <dmalcolm (a] redhat.com> 7983 7984 PR analyzer/99196 7985 * engine.cc (exploded_node::on_stmt): Provide terminate_path 7986 flag as a way for on_call_pre to terminate the current analysis 7987 path. 7988 * region-model-impl-calls.cc (call_details::num_args): New. 7989 (region_model::impl_call_error): New. 7990 * region-model.cc (region_model::on_call_pre): Add param 7991 "out_terminate_path". Handle "error" and "error_at_line". 7992 * region-model.h (call_details::num_args): New decl. 7993 (region_model::on_call_pre): Add param "out_terminate_path". 7994 (region_model::impl_call_error): New decl. 7995 7996 2021-02-17 David Malcolm <dmalcolm (a] redhat.com> 7997 7998 PR analyzer/98969 7999 * constraint-manager.cc (dead_svalue_purger::should_purge_p): 8000 Update for change to svalue::live_p. 8001 * program-state.cc (sm_state_map::on_liveness_change): Likewise. 8002 (program_state::detect_leaks): Likewise. 8003 * region-model-reachability.cc (reachable_regions::init_cluster): 8004 When dealing with a symbolic region, if the underlying pointer is 8005 implicitly live, add the region to the reachable regions. 8006 * region-model.cc (region_model::compare_initial_and_pointer): 8007 Move logic for detecting initial values of params to 8008 initial_svalue::initial_value_of_param_p. 8009 * svalue.cc (svalue::live_p): Convert "live_svalues" from a 8010 reference to a pointer; support it being NULL. 8011 (svalue::implicitly_live_p): Convert first param from a 8012 refererence to a pointer. 8013 (region_svalue::implicitly_live_p): Likewise. 8014 (constant_svalue::implicitly_live_p): Likewise. 8015 (initial_svalue::implicitly_live_p): Likewise. Treat the initial 8016 values of params for the top level frame as still live. 8017 (initial_svalue::initial_value_of_param_p): New function, taken 8018 from a test in region_model::compare_initial_and_pointer. 8019 (unaryop_svalue::implicitly_live_p): Convert first param from a 8020 refererence to a pointer. 8021 (binop_svalue::implicitly_live_p): Likewise. 8022 (sub_svalue::implicitly_live_p): Likewise. 8023 (unmergeable_svalue::implicitly_live_p): Likewise. 8024 * svalue.h (svalue::live_p): Likewise. 8025 (svalue::implicitly_live_p): Likewise. 8026 (region_svalue::implicitly_live_p): Likewise. 8027 (constant_svalue::implicitly_live_p): Likewise. 8028 (initial_svalue::implicitly_live_p): Likewise. 8029 (initial_svalue::initial_value_of_param_p): New decl. 8030 (unaryop_svalue::implicitly_live_p): Convert first param from a 8031 refererence to a pointer. 8032 (binop_svalue::implicitly_live_p): Likewise. 8033 (sub_svalue::implicitly_live_p): Likewise. 8034 (unmergeable_svalue::implicitly_live_p): Likewise. 8035 8036 2021-02-12 David Malcolm <dmalcolm (a] redhat.com> 8037 8038 PR analyzer/98969 8039 * engine.cc (readability): Add names for the various arbitrary 8040 values. Handle NOP_EXPR and INTEGER_CST. 8041 (readability_comparator): Combine the readability tests for 8042 tree and stack depth, rather than performing them sequentially. 8043 (impl_region_model_context::on_state_leak): Strip off top-level 8044 casts. 8045 * region-model.cc (region_model::get_representative_path_var): Add 8046 type-checking, moving the bulk of the implementation to... 8047 (region_model::get_representative_path_var_1): ...here. Respect 8048 types in casts by recursing and re-adding the cast, rather than 8049 merely stripping them off. Use the correct type when handling 8050 region_svalue. 8051 (region_model::get_representative_tree): Strip off any top-level 8052 cast. 8053 (region_model::get_representative_path_var): Add type-checking, 8054 moving the bulk of the implementation to... 8055 (region_model::get_representative_path_var_1): ...here. 8056 * region-model.h (region_model::get_representative_path_var_1): 8057 New decl 8058 (region_model::get_representative_path_var_1): New decl. 8059 * store.cc (append_pathvar_with_type): New. 8060 (binding_cluster::get_representative_path_vars): Cast path_vars 8061 to the correct type when adding them to *OUT_PVS. 8062 8063 2021-02-09 David Malcolm <dmalcolm (a] redhat.com> 8064 8065 PR analyzer/98575 8066 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed 8067 variants. 8068 8069 2021-02-09 David Malcolm <dmalcolm (a] redhat.com> 8070 8071 PR analyzer/98575 8072 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN 8073 as having escaped. 8074 8075 2021-02-02 David Malcolm <dmalcolm (a] redhat.com> 8076 8077 PR analyzer/93355 8078 PR analyzer/96374 8079 * engine.cc (toplevel_function_p): Simplify so that 8080 we only reject functions with a "__analyzer_" prefix. 8081 (add_any_callbacks): Delete. 8082 (exploded_graph::build_initial_worklist): Update for 8083 dropped param of toplevel_function_p. 8084 (exploded_graph::build_initial_worklist): Don't bother 8085 looking for callbacks that are reachable from global 8086 initializers. 8087 8088 2021-02-01 David Malcolm <dmalcolm (a] redhat.com> 8089 8090 PR analyzer/98918 8091 * region-model-manager.cc 8092 (region_model_manager::get_or_create_initial_value): 8093 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value. 8094 (region_model_manager::get_field_region): Fold the value 8095 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE. 8096 8097 2021-01-29 David Malcolm <dmalcolm (a] redhat.com> 8098 8099 * checker-path.cc (event_kind_to_string): Handle 8100 EK_START_CONSOLIDATED_CFG_EDGES and 8101 EK_END_CONSOLIDATED_CFG_EDGES. 8102 (start_consolidated_cfg_edges_event::get_desc): New. 8103 (checker_path::cfg_edge_pair_at_p): New. 8104 * checker-path.h (enum event_kind): Add 8105 EK_START_CONSOLIDATED_CFG_EDGES and 8106 EK_END_CONSOLIDATED_CFG_EDGES. 8107 (class start_consolidated_cfg_edges_event): New class. 8108 (class end_consolidated_cfg_edges_event): New class. 8109 (checker_path::delete_events): New. 8110 (checker_path::replace_event): New. 8111 (checker_path::cfg_edge_pair_at_p): New decl. 8112 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call 8113 consolidate_conditions. 8114 (same_line_as_p): New. 8115 (diagnostic_manager::consolidate_conditions): New. 8116 * diagnostic-manager.h 8117 (diagnostic_manager::consolidate_conditions): New decl. 8118 8119 2021-01-18 David Malcolm <dmalcolm (a] redhat.com> 8120 8121 * analyzer.h (is_std_named_call_p): New decl. 8122 * diagnostic-manager.cc (path_builder::get_sm): New. 8123 (state_change_event_creator::state_change_event_creator): Add "pb" 8124 param. 8125 (state_change_event_creator::on_global_state_change): Don't consider 8126 state changes affecting other state_machines. 8127 (state_change_event_creator::on_state_change): Likewise. 8128 (state_change_event_creator::m_pb): New field. 8129 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor 8130 ctor. 8131 * region-model-impl-calls.cc 8132 (region_model::impl_deallocation_call): New. 8133 * region-model.cc: Include "attribs.h". 8134 (region_model::on_call_post): Handle fndecls referenced by 8135 __attribute__((deallocated_by(FOO))). 8136 * region-model.h (region_model::impl_deallocation_call): New decl. 8137 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add 8138 leading comment. 8139 (class api): Delete. 8140 (enum resource_state): Update comment for change from api to 8141 deallocator and deallocator_set. 8142 (allocation_state::allocation_state): Drop api param. Add 8143 "deallocators" and "deallocator". 8144 (allocation_state::m_api): Drop field in favor of... 8145 (allocation_state::m_deallocators): New field. 8146 (allocation_state::m_deallocator): New field. 8147 (enum wording): Add WORDING_DEALLOCATED. 8148 (struct deallocator): New. 8149 (struct standard_deallocator): New. 8150 (struct custom_deallocator): New. 8151 (struct deallocator_set): New. 8152 (struct custom_deallocator_set): New. 8153 (struct standard_deallocator_set): New. 8154 (struct deallocator_set_map_traits): New. 8155 (malloc_state_machine::m_malloc): Drop field 8156 (malloc_state_machine::m_scalar_new): Likewise. 8157 (malloc_state_machine::m_vector_new): Likewise. 8158 (malloc_state_machine::m_free): New field 8159 (malloc_state_machine::m_scalar_delete): Likewise. 8160 (malloc_state_machine::m_vector_delete): Likewise. 8161 (malloc_state_machine::deallocator_map_t): New typedef. 8162 (malloc_state_machine::m_deallocator_map): New field. 8163 (malloc_state_machine::deallocator_set_cache_t): New typedef. 8164 (malloc_state_machine::m_custom_deallocator_set_cache): New field. 8165 (malloc_state_machine::custom_deallocator_set_map_t): New typedef. 8166 (malloc_state_machine::m_custom_deallocator_set_map): New field. 8167 (malloc_state_machine::m_dynamic_sets): New field. 8168 (malloc_state_machine::m_dynamic_deallocators): New field. 8169 (api::api): Delete. 8170 (deallocator::deallocator): New ctor. 8171 (deallocator::hash): New. 8172 (deallocator::dump_to_pp): New. 8173 (deallocator::cmp): New. 8174 (deallocator::cmp_ptr_ptr): New. 8175 (standard_deallocator::standard_deallocator): New ctor. 8176 (deallocator_set::deallocator_set): New ctor. 8177 (deallocator_set::dump): New. 8178 (custom_deallocator_set::custom_deallocator_set): New ctor. 8179 (custom_deallocator_set::contains_p): New. 8180 (custom_deallocator_set::maybe_get_single): New. 8181 (custom_deallocator_set::dump_to_pp): New. 8182 (standard_deallocator_set::standard_deallocator_set): New ctor. 8183 (standard_deallocator_set::contains_p): New. 8184 (standard_deallocator_set::maybe_get_single): New. 8185 (standard_deallocator_set::dump_to_pp): New. 8186 (start_p): New. 8187 (class mismatching_deallocation): Update for conversion from api 8188 to deallocator_set and deallocator. 8189 (double_free::emit): Use %qs. 8190 (class use_after_free): Update for conversion from api to 8191 deallocator_set and deallocator. 8192 (malloc_leak::describe_state_change): Only emit "allocated here" on 8193 a start->nonnull transition, rather than on other transitions to 8194 nonnull. 8195 (allocation_state::dump_to_pp): Update for conversion from api to 8196 deallocator_set. 8197 (allocation_state::get_nonnull): Likewise. 8198 (malloc_state_machine::malloc_state_machine): Likewise. 8199 (malloc_state_machine::~malloc_state_machine): New. 8200 (malloc_state_machine::add_state): Update for conversion from api 8201 to deallocator_set. 8202 (malloc_state_machine::get_or_create_custom_deallocator_set): New. 8203 (malloc_state_machine::maybe_create_custom_deallocator_set): New. 8204 (malloc_state_machine::get_or_create_deallocator): New. 8205 (malloc_state_machine::on_stmt): Update for conversion from api 8206 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and 8207 the special attribute set on FOO. 8208 (malloc_state_machine::on_allocator_call): Update for conversion 8209 from api to deallocator_set. Add "returns_nonnull" param and use 8210 it to affect which state to transition to. 8211 (malloc_state_machine::on_deallocator_call): Update for conversion 8212 from api to deallocator_set. 8213 8214 2021-01-14 David Malcolm <dmalcolm (a] redhat.com> 8215 8216 * engine.cc (strongly_connected_components::to_json): New. 8217 (worklist::to_json): New. 8218 (exploded_graph::to_json): JSON-ify the worklist. 8219 * exploded-graph.h (strongly_connected_components::to_json): New 8220 decl. 8221 (worklist::to_json): New decl. 8222 * store.cc (store::to_json): Fix comment. 8223 * supergraph.cc (supernode::to_json): Fix reference to 8224 "returning_call" in comment. Add optional "fun" to JSON. 8225 (edge_kind_to_string): New. 8226 (superedge::to_json): Add "kind" to JSON. 8227 8228 2021-01-14 David Malcolm <dmalcolm (a] redhat.com> 8229 8230 PR analyzer/98679 8231 * analyzer.h (region_offset::operator==): Make const. 8232 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise. 8233 * store.h (binding_cluster::for_each_value): Likewise. 8234 (binding_cluster::for_each_binding): Likewise. 8235 8236 2021-01-12 David Malcolm <dmalcolm (a] redhat.com> 8237 8238 PR analyzer/98628 8239 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark 8240 dereferenced unknown pointers as having escaped. 8241 8242 2021-01-07 David Malcolm <dmalcolm (a] redhat.com> 8243 8244 PR analyzer/98580 8245 * region.cc (decl_region::get_svalue_for_initializer): Gracefully 8246 handle when LTO writes out DECL_INITIAL as error_mark_node. 8247 8248 2021-01-07 David Malcolm <dmalcolm (a] redhat.com> 8249 8250 PR analyzer/97074 8251 * store.cc (binding_cluster::can_merge_p): Add "out_store" param 8252 and pass to calls to binding_cluster::make_unknown_relative_to. 8253 (binding_cluster::make_unknown_relative_to): Add "out_store" 8254 param. Use it to mark base regions that are pointed to by 8255 pointers that become unknown as having escaped. 8256 (store::can_merge_p): Pass out_store to 8257 binding_cluster::can_merge_p. 8258 * store.h (binding_cluster::can_merge_p): Add "out_store" param. 8259 (binding_cluster::make_unknown_relative_to): Likewise. 8260 * svalue.cc (region_svalue::implicitly_live_p): New vfunc. 8261 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl. 8262 8263 2021-01-07 David Malcolm <dmalcolm (a] redhat.com> 8264 8265 PR analyzer/98564 8266 * engine.cc (exploded_path::feasible_p): Add missing call to 8267 bitmap_clear. 8268 8269 2021-01-06 David Malcolm <dmalcolm (a] redhat.com> 8270 8271 PR analyzer/97072 8272 * region-model-reachability.cc (reachable_regions::init_cluster): 8273 Convert symbolic region handling to a switch statement. Add cases 8274 to handle SK_UNKNOWN and SK_CONJURED. 8275 8276 2021-01-05 David Malcolm <dmalcolm (a] redhat.com> 8277 8278 PR analyzer/98293 8279 * store.cc (binding_map::apply_ctor_to_region): When "index" is 8280 NULL, iterate through the fields for RECORD_TYPEs, rather than 8281 creating an INTEGER_CST index. 8282 8283 2020-11-30 David Malcolm <dmalcolm (a] redhat.com> 8284 8285 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the 8286 declaration of sorry_no_analyzer; include "tree.h" and 8287 "function.h" as these are needed by it. 8288 8289 2020-11-30 David Malcolm <dmalcolm (a] redhat.com> 8290 8291 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to... 8292 (sorry_no_analyzer): New. 8293 * analyzer.h (class state_machine): New forward decl. 8294 (class logger): New forward decl. 8295 (class plugin_analyzer_init_iface): New. 8296 (sorry_no_analyzer): New decl. 8297 * checker-path.cc (checker_path::fixup_locations): New. 8298 * checker-path.h (checker_event::set_location): New. 8299 (checker_path::fixup_locations): New decl. 8300 * diagnostic-manager.cc 8301 (diagnostic_manager::emit_saved_diagnostic): Call 8302 checker_path::fixup_locations, and call fixup_location 8303 on the primary location. 8304 * engine.cc: Include "plugin.h". 8305 (class plugin_analyzer_init_impl): New. 8306 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks. 8307 * pending-diagnostic.h (pending_diagnostic::fixup_location): New 8308 vfunc. 8309 8310 2020-11-18 David Malcolm <dmalcolm (a] redhat.com> 8311 8312 PR analyzer/97893 8313 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than 8314 CWE-690, as this isn't due to an unchecked return value. 8315 (null_arg::emit): Likewise. 8316 8317 2020-11-12 David Malcolm <dmalcolm (a] redhat.com> 8318 8319 * checker-path.h (checker_event::get_id_ptr): New. 8320 * diagnostic-manager.cc (path_builder::path_builder): Add "sd" 8321 param and use it to initialize new field "m_sd". 8322 (path_builder::get_pending_diagnostic): New. 8323 (path_builder::m_sd): New field. 8324 (diagnostic_manager::emit_saved_diagnostic): Pass sd to 8325 path_builder ctor. 8326 (diagnostic_manager::add_events_for_superedge): Call new 8327 maybe_add_custom_events_for_superedge vfunc. 8328 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point" 8329 param and use it to initialize new field "m_setjmp_point". 8330 Initialize new field "m_stack_pop_event". 8331 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc 8332 implementation. 8333 (stale_jmp_buf::describe_final_event): New vfunc implementation. 8334 (stale_jmp_buf::m_setjmp_point): New field. 8335 (stale_jmp_buf::m_stack_pop_event): New field. 8336 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf 8337 ctor. 8338 * pending-diagnostic.h 8339 (pending_diagnostic::maybe_add_custom_events_for_superedge): New 8340 vfunc. 8341 8342 2020-11-12 David Malcolm <dmalcolm (a] redhat.com> 8343 8344 PR tree-optimization/97424 8345 * analyzer.opt (Wanalyzer-shift-count-negative): New. 8346 (Wanalyzer-shift-count-overflow): New. 8347 * region-model.cc (class shift_count_negative_diagnostic): New. 8348 (class shift_count_overflow_diagnostic): New. 8349 (region_model::get_gassign_result): Complain about shift counts that 8350 are negative or are >= the operand's type's width. 8351 8352 2020-11-10 Martin Liska <mliska (a] suse.cz> 8353 8354 * constraint-manager.cc (constraint_manager::merge): Remove 8355 unused code. 8356 * constraint-manager.h: Likewise. 8357 * program-state.cc (sm_state_map::sm_state_map): Likewise. 8358 (program_state::program_state): Likewise. 8359 (test_sm_state_map): Likewise. 8360 * program-state.h: Likewise. 8361 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise. 8362 * region-model-reachability.h: Likewise. 8363 * region-model.cc (region_model::handle_unrecognized_call): Likewise. 8364 (region_model::get_reachable_svalues): Likewise. 8365 (region_model::can_merge_with_p): Likewise. 8366 8367 2020-11-05 David Malcolm <dmalcolm (a] redhat.com> 8368 8369 PR analyzer/97668 8370 * svalue.cc (cmp_cst): Handle COMPLEX_CST. 8371 8372 2020-10-29 David Malcolm <dmalcolm (a] redhat.com> 8373 8374 * program-state.cc (sm_state_map::on_liveness_change): Sort the 8375 leaking svalues before calling on_state_leak. 8376 (program_state::detect_leaks): Likewise when calling 8377 on_svalue_leak. 8378 * region-model-reachability.cc 8379 (reachable_regions::mark_escaped_clusters): Likewise when 8380 calling on_escaped_function. 8381 8382 2020-10-29 David Malcolm <dmalcolm (a] redhat.com> 8383 8384 PR analyzer/97608 8385 * region-model-reachability.cc (reachable_regions::handle_sval): 8386 Operands of reachable reversible operations are reachable. 8387 8388 2020-10-29 David Malcolm <dmalcolm (a] redhat.com> 8389 8390 * analyzer.h (class state_machine): New forward decl. 8391 (class logger): Likewise. 8392 (class visitor): Likewise. 8393 * complexity.cc: New file, taken from svalue.cc. 8394 * complexity.h: New file, taken from region-model.h. 8395 * region-model.h: Include "analyzer/svalue.h" and 8396 "analyzer/region.h". Move struct complexity to complexity.h. 8397 Move svalue, its subclasses and supporting decls to svalue.h. 8398 Move region, its subclasses and supporting decls to region.h. 8399 * region.cc: Include "analyzer/region.h". 8400 (symbolic_region::symbolic_region): Move here from region-model.h. 8401 * region.h: New file, based on material from region-model.h. 8402 * svalue.cc: Include "analyzer/svalue.h". 8403 (complexity::complexity): Move to complexity.cc. 8404 (complexity::from_pair): Likewise. 8405 * svalue.h: New file, based on material from region-model.h. 8406 8407 2020-10-29 David Malcolm <dmalcolm (a] redhat.com> 8408 8409 * program-state.cc (sm_state_map::print): Guard the printing of 8410 the origin pointer with !flag_dump_noaddr. 8411 * region.cc (string_region::dump_to_pp): Likewise for 8412 m_string_cst. 8413 8414 2020-10-27 David Malcolm <dmalcolm (a] redhat.com> 8415 8416 PR analyzer/97568 8417 * region-model.cc (region_model::get_initial_value_for_global): 8418 Move check that !DECL_EXTERNAL from here to... 8419 * region.cc (decl_region::get_svalue_for_initializer): ...here, 8420 using it to reject zero initialization. 8421 8422 2020-10-27 Markus Bck <markus.boeck02 (a] gmail.com> 8423 8424 PR analyzer/96608 8425 * store.h (hash): Cast to intptr_t instead of long 8426 8427 2020-10-27 David Malcolm <dmalcolm (a] redhat.com> 8428 8429 * constraint-manager.cc (svalue_cmp_by_ptr): Delete. 8430 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead. 8431 (equiv_class_cmp): Eliminate pointer comparison. 8432 * diagnostic-manager.cc (dedupe_key::comparator): If they are at 8433 the same location, also compare epath ength and pending_diagnostic 8434 kind. 8435 * engine.cc (readability_comparator): If two path_vars have the 8436 same readability, then impose an arbitrary ordering on them. 8437 (worklist::key_t::cmp): If two points have the same plan ordering, 8438 continue the comparison. Call sm_state_map::cmp rather than 8439 comparing hash values. 8440 * program-state.cc (sm_state_map::entry_t::cmp): New. 8441 (sm_state_map::cmp): New. 8442 * program-state.h (sm_state_map::entry_t::cmp): New decl. 8443 (sm_state_map::elements): New. 8444 (sm_state_map::cmp): New. 8445 8446 2020-10-27 David Malcolm <dmalcolm (a] redhat.com> 8447 8448 * engine.cc (setjmp_record::cmp): New. 8449 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster 8450 name. 8451 (supernode_cluster::cmp_ptr_ptr): New. 8452 (function_call_string_cluster::dump_dot): Avoid embedding pointer 8453 in cluster name. Sort m_map when dumping child clusters. 8454 (function_call_string_cluster::cmp_ptr_ptr): New. 8455 (root_cluster::dump_dot): Sort m_map when dumping child clusters. 8456 * program-point.cc (function_point::cmp): New. 8457 (function_point::cmp_ptr): New. 8458 * program-point.h (function_point::cmp): New decl. 8459 (function_point::cmp_ptr): New decl. 8460 * program-state.cc (sm_state_map::print): Sort the values. Guard 8461 the printing of pointers with !flag_dump_noaddr. 8462 (program_state::prune_for_point): Sort the regions. 8463 (log_set_of_svalues): Sort the values. Guard the printing of 8464 pointers with !flag_dump_noaddr. 8465 * region-model-manager.cc (log_uniq_map): Sort the values. 8466 * region-model-reachability.cc (dump_set): New function template. 8467 (reachable_regions::dump_to_pp): Use it. 8468 * region-model.h (svalue::cmp_ptr): New decl. 8469 (svalue::cmp_ptr_ptr): New decl. 8470 (setjmp_record::cmp): New decl. 8471 (placeholder_svalue::get_name): New accessor. 8472 (widening_svalue::get_point): New accessor. 8473 (compound_svalue::get_map): New accessor. 8474 (conjured_svalue::get_stmt): New accessor. 8475 (conjured_svalue::get_id_region): New accessor. 8476 (region::cmp_ptrs): Rename to... 8477 (region::cmp_ptr_ptr): ...this. 8478 * region.cc (region::cmp_ptrs): Rename to... 8479 (region::cmp_ptr_ptr): ...this. 8480 * state-purge.cc 8481 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort 8482 m_points_needing_name when dumping. 8483 * store.cc (concrete_binding::cmp_ptr_ptr): New. 8484 (symbolic_binding::cmp_ptr_ptr): New. 8485 (binding_map::cmp): New. 8486 (get_sorted_parent_regions): Update for renaming of 8487 region::cmp_ptrs to region::cmp_ptr_ptr. 8488 (store::dump_to_pp): Likewise. 8489 (store::to_json): Likewise. 8490 (store::can_merge_p): Sort the base regions before considering 8491 them. 8492 * store.h (concrete_binding::cmp_ptr_ptr): New decl. 8493 (symbolic_binding::cmp_ptr_ptr): New decl. 8494 (binding_map::cmp): New decl. 8495 * supergraph.cc (supergraph::supergraph): Assign UIDs to the 8496 gimple stmts. 8497 * svalue.cc (cmp_cst): New. 8498 (svalue::cmp_ptr): New. 8499 (svalue::cmp_ptr_ptr): New. 8500 8501 2020-10-27 David Malcolm <dmalcolm (a] redhat.com> 8502 8503 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one 8504 when imposing param_analyzer_max_enodes_per_program_point limit. 8505 8506 2020-10-27 David Malcolm <dmalcolm (a] redhat.com> 8507 8508 * region-model.cc (region_model::get_representative_path_var): 8509 Implement case RK_LABEL. 8510 * region-model.h (label_region::get_label): New accessor. 8511 8512 2020-10-22 David Malcolm <dmalcolm (a] redhat.com> 8513 8514 PR analyzer/97514 8515 * engine.cc (exploded_graph::add_function_entry): Handle failure 8516 to create an enode, rather than asserting. 8517 8518 2020-10-22 David Malcolm <dmalcolm (a] redhat.com> 8519 8520 PR analyzer/97489 8521 * engine.cc (exploded_graph::add_function_entry): Assert that we 8522 have a function body. 8523 (exploded_graph::on_escaped_function): Reject fndecls that don't 8524 have a function body. 8525 8526 2020-10-14 David Malcolm <dmalcolm (a] redhat.com> 8527 8528 PR analyzer/93388 8529 * region-model.cc (region_model::get_initial_value_for_global): 8530 Fall back to returning an initial_svalue if 8531 decl_region::get_svalue_for_initializer fails. 8532 * region.cc (decl_region::get_svalue_for_initializer): Don't 8533 attempt to create a compound_svalue if the region has an unknown 8534 size. 8535 8536 2020-10-14 David Malcolm <dmalcolm (a] redhat.com> 8537 8538 PR analyzer/93723 8539 * store.cc (binding_map::apply_ctor_to_region): Remove redundant 8540 assertion. 8541 8542 2020-10-12 David Malcolm <dmalcolm (a] redhat.com> 8543 8544 PR analyzer/97258 8545 * engine.cc (impl_region_model_context::on_escaped_function): New 8546 vfunc. 8547 (exploded_graph::add_function_entry): Use m_functions_with_enodes 8548 to implement idempotency. 8549 (add_any_callbacks): New. 8550 (exploded_graph::build_initial_worklist): Use the above to find 8551 callbacks that are reachable from global initializers. 8552 (exploded_graph::on_escaped_function): New. 8553 * exploded-graph.h 8554 (impl_region_model_context::on_escaped_function): New decl. 8555 (exploded_graph::on_escaped_function): New decl. 8556 (exploded_graph::m_functions_with_enodes): New field. 8557 * region-model-reachability.cc 8558 (reachable_regions::reachable_regions): Replace "store" param with 8559 "model" param; use it to initialize m_model. 8560 (reachable_regions::add): When getting the svalue for the region, 8561 call get_store_value on the model rather than using an initial 8562 value. 8563 (reachable_regions::mark_escaped_clusters): Add ctxt param and 8564 use it to call on_escaped_function when a function_region escapes. 8565 * region-model-reachability.h 8566 (reachable_regions::reachable_regions): Replace "store" param with 8567 "model" param. 8568 (reachable_regions::mark_escaped_clusters): Add ctxt param. 8569 (reachable_regions::m_model): New field. 8570 * region-model.cc (region_model::handle_unrecognized_call): Update 8571 for change in reachable_regions ctor. 8572 (region_model::handle_unrecognized_call): Pass ctxt to 8573 mark_escaped_clusters. 8574 (region_model::get_reachable_svalues): Update for change in 8575 reachable_regions ctor. 8576 (region_model::get_initial_value_for_global): Read-only variables 8577 keep their initial values. 8578 * region-model.h (region_model_context::on_escaped_function): New 8579 vfunc. 8580 (noop_region_model_context::on_escaped_function): New. 8581 8582 2020-10-12 David Malcolm <dmalcolm (a] redhat.com> 8583 8584 * analyzer.opt (Wanalyzer-write-to-const): New. 8585 (Wanalyzer-write-to-string-literal): New. 8586 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 8587 Call check_for_writable_region. 8588 (region_model::impl_call_memset): Likewise. 8589 (region_model::impl_call_strcpy): Likewise. 8590 * region-model.cc (class write_to_const_diagnostic): New. 8591 (class write_to_string_literal_diagnostic): New. 8592 (region_model::check_for_writable_region): New. 8593 (region_model::set_value): Call check_for_writable_region. 8594 * region-model.h (region_model::check_for_writable_region): New 8595 decl. 8596 8597 2020-10-07 David Malcolm <dmalcolm (a] redhat.com> 8598 8599 PR analyzer/97116 8600 * sm-malloc.cc (method_p): New. 8601 (describe_argument_index): New. 8602 (inform_nonnull_attribute): Use describe_argument_index. 8603 (possible_null_arg::describe_final_event): Likewise. 8604 (null_arg::describe_final_event): Likewise. 8605 8606 2020-09-29 David Malcolm <dmalcolm (a] redhat.com> 8607 8608 PR analyzer/95188 8609 * engine.cc (stmt_requires_new_enode_p): Split enodes before 8610 "signal" calls. 8611 8612 2020-09-29 David Malcolm <dmalcolm (a] redhat.com> 8613 8614 * constraint-manager.cc 8615 (constraint_manager::add_constraint_internal): Whitespace fixes. 8616 Silence -Wsign-compare warning. 8617 * engine.cc (maybe_process_run_of_before_supernode_enodes): 8618 Silence -Wsign-compare warning. 8619 8620 2020-09-28 David Malcolm <dmalcolm (a] redhat.com> 8621 8622 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove 8623 redundant "virtual". Add FINAL OVERRIDE. 8624 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE. 8625 (compound_svalue::dyn_cast_compound_svalue): Likewise. 8626 (conjured_svalue::dyn_cast_conjured_svalue): Likewise. 8627 8628 2020-09-28 David Malcolm <dmalcolm (a] redhat.com> 8629 8630 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor): 8631 Remove unused field. 8632 8633 2020-09-28 David Malcolm <dmalcolm (a] redhat.com> 8634 8635 PR analyzer/97233 8636 * analyzer.cc (is_longjmp_call_p): Require the initial argument 8637 to be a pointer. 8638 * engine.cc (exploded_node::on_longjmp): Likewise. 8639 8640 2020-09-28 David Malcolm <dmalcolm (a] redhat.com> 8641 8642 * program-state.cc (sm_state_map::print): Update check 8643 for m_global_state being the start state. 8644 8645 2020-09-26 David Malcolm <dmalcolm (a] redhat.com> 8646 8647 PR analyzer/96646 8648 PR analyzer/96841 8649 * region-model.cc (region_model::get_representative_path_var): 8650 When handling offset_region, wrap the MEM_REF's first argument in 8651 an ADDR_EXPR of pointer type, rather than simply using the tree 8652 for the parent region. Require the MEM_REF's second argument to 8653 be an integer constant. 8654 8655 2020-09-24 David Malcolm <dmalcolm (a] redhat.com> 8656 8657 * analyzer.h (struct rejected_constraint): New decl. 8658 * analyzer.opt (fanalyzer-feasibility): New option. 8659 * diagnostic-manager.cc (path_builder::path_builder): Add 8660 "problem" param and use it to initialize new field. 8661 (path_builder::get_feasibility_problem): New accessor. 8662 (path_builder::m_feasibility_problem): New field. 8663 (dedupe_winners::add): Remove inversion of logic in "if" clause, 8664 swapping if/else suites. In the !feasible_p suite, inspect 8665 flag_analyzer_feasibility and add code to handle when this 8666 is off, accepting the infeasible path, but recording the 8667 feasibility_problem. 8668 (diagnostic_manager::emit_saved_diagnostic): Pass the 8669 feasibility_problem to the path_builder. 8670 (diagnostic_manager::add_events_for_eedge): If we have 8671 a feasibility_problem at this edge, use it to add a custom event. 8672 * engine.cc (exploded_path::feasible_p): Pass a 8673 rejected_constraint ** to model.maybe_update_for_edge and transfer 8674 ownership of any created instance to any feasibility_problem. 8675 (feasibility_problem::dump_to_pp): New. 8676 * exploded-graph.h (feasibility_problem::feasibility_problem): 8677 Drop "model" param; add rejected_constraint * param. 8678 (feasibility_problem::~feasibility_problem): New. 8679 (feasibility_problem::dump_to_pp): New decl. 8680 (feasibility_problem::m_model): Drop field. 8681 (feasibility_problem::m_rc): New field. 8682 * program-point.cc (function_point::get_location): Handle 8683 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE. 8684 * program-state.cc (program_state::on_edge): Pass NULL to new 8685 param of region_model::maybe_update_for_edge. 8686 * region-model.cc (region_model::add_constraint): New overload 8687 adding a rejected_constraint ** param. 8688 (region_model::maybe_update_for_edge): Add rejected_constraint ** 8689 param and pass it to the various apply_constraints_for_ calls. 8690 (region_model::apply_constraints_for_gcond): Add 8691 rejected_constraint ** param and pass it to add_constraint calls. 8692 (region_model::apply_constraints_for_gswitch): Likewise. 8693 (region_model::apply_constraints_for_exception): Likewise. 8694 (rejected_constraint::dump_to_pp): New. 8695 * region-model.h (region_model::maybe_update_for_edge): 8696 Add rejected_constraint ** param. 8697 (region_model::add_constraint): New overload adding a 8698 rejected_constraint ** param. 8699 (region_model::apply_constraints_for_gcond): Add 8700 rejected_constraint ** param. 8701 (region_model::apply_constraints_for_gswitch): Likewise. 8702 (region_model::apply_constraints_for_exception): Likewise. 8703 (struct rejected_constraint): New. 8704 8705 2020-09-23 David Malcolm <dmalcolm (a] redhat.com> 8706 8707 PR analyzer/97178 8708 * engine.cc (impl_run_checkers): Update for change to ext_state 8709 ctor. 8710 * program-state.cc (selftest::test_sm_state_map): Pass an engine 8711 instance to ext_state ctor. 8712 (selftest::test_program_state_1): Likewise. 8713 (selftest::test_program_state_2): Likewise. 8714 (selftest::test_program_state_merging): Likewise. 8715 (selftest::test_program_state_merging_2): Likewise. 8716 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL 8717 default value for "eng" param. 8718 8719 2020-09-23 Tobias Burnus <tobias (a] codesourcery.com> 8720 8721 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"' 8722 by '#if __GNUC__ >= 10' 8723 * analyzer.h: Likewise. 8724 * call-string.cc: Likewise. 8725 8726 2020-09-23 David Malcolm <dmalcolm (a] redhat.com> 8727 8728 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast 8729 with switch. 8730 8731 2020-09-22 David Malcolm <dmalcolm (a] redhat.com> 8732 8733 * analysis-plan.cc: Include "json.h". 8734 * analyzer.opt (fdump-analyzer-json): New. 8735 * call-string.cc: Include "json.h". 8736 (call_string::to_json): New. 8737 * call-string.h (call_string::to_json): New decl. 8738 * checker-path.cc: Include "json.h". 8739 * constraint-manager.cc: Include "json.h". 8740 (equiv_class::to_json): New. 8741 (constraint::to_json): New. 8742 (constraint_manager::to_json): New. 8743 * constraint-manager.h (equiv_class::to_json): New decl. 8744 (constraint::to_json): New decl. 8745 (constraint_manager::to_json): New decl. 8746 * diagnostic-manager.cc: Include "json.h". 8747 (saved_diagnostic::to_json): New. 8748 (diagnostic_manager::to_json): New. 8749 * diagnostic-manager.h (saved_diagnostic::to_json): New decl. 8750 (diagnostic_manager::to_json): New decl. 8751 * engine.cc: Include "json.h", <zlib.h>. 8752 (exploded_node::status_to_str): New. 8753 (exploded_node::to_json): New. 8754 (exploded_edge::to_json): New. 8755 (exploded_graph::to_json): New. 8756 (dump_analyzer_json): New. 8757 (impl_run_checkers): Call it. 8758 * exploded-graph.h (exploded_node::status_to_str): New decl. 8759 (exploded_node::to_json): New. 8760 (exploded_edge::to_json): New. 8761 (exploded_graph::to_json): New. 8762 * pending-diagnostic.cc: Include "json.h". 8763 * program-point.cc: Include "json.h". 8764 (program_point::to_json): New. 8765 * program-point.h (program_point::to_json): New decl. 8766 * program-state.cc: Include "json.h". 8767 (extrinsic_state::to_json): New. 8768 (sm_state_map::to_json): New. 8769 (program_state::to_json): New. 8770 * program-state.h (extrinsic_state::to_json): New decl. 8771 (sm_state_map::to_json): New decl. 8772 (program_state::to_json): New decl. 8773 * region-model-impl-calls.cc: Include "json.h". 8774 * region-model-manager.cc: Include "json.h". 8775 * region-model-reachability.cc: Include "json.h". 8776 * region-model.cc: Include "json.h". 8777 * region-model.h (svalue::to_json): New decl. 8778 (region::to_json): New decl. 8779 * region.cc: Include "json.h". 8780 (region::to_json: New. 8781 * sm-file.cc: Include "json.h". 8782 * sm-malloc.cc: Include "json.h". 8783 * sm-pattern-test.cc: Include "json.h". 8784 * sm-sensitive.cc: Include "json.h". 8785 * sm-signal.cc: Include "json.h". 8786 (signal_delivery_edge_info_t::to_json): New. 8787 * sm-taint.cc: Include "json.h". 8788 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and 8789 "json.h". 8790 (state_machine::state::to_json): New. 8791 (state_machine::to_json): New. 8792 * sm.h (state_machine::state::to_json): New. 8793 (state_machine::to_json): New. 8794 * state-purge.cc: Include "json.h". 8795 * store.cc: Include "json.h". 8796 (binding_key::get_desc): New. 8797 (binding_map::to_json): New. 8798 (binding_cluster::to_json): New. 8799 (store::to_json): New. 8800 * store.h (binding_key::get_desc): New decl. 8801 (binding_map::to_json): New decl. 8802 (binding_cluster::to_json): New decl. 8803 (store::to_json): New decl. 8804 * supergraph.cc: Include "json.h". 8805 (supergraph::to_json): New. 8806 (supernode::to_json): New. 8807 (superedge::to_json): New. 8808 * supergraph.h (supergraph::to_json): New decl. 8809 (supernode::to_json): New decl. 8810 (superedge::to_json): New decl. 8811 * svalue.cc: Include "json.h". 8812 (svalue::to_json): New. 8813 8814 2020-09-21 David Malcolm <dmalcolm (a] redhat.com> 8815 8816 PR analyzer/97130 8817 * region-model-impl-calls.cc (call_details::get_arg_type): New. 8818 * region-model.cc (region_model::on_call_pre): Check that the 8819 initial arg is a pointer before calling impl_call_memset and 8820 impl_call_strlen. 8821 * region-model.h (call_details::get_arg_type): New decl. 8822 8823 2020-09-21 David Malcolm <dmalcolm (a] redhat.com> 8824 8825 PR analyzer/93355 8826 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at 8827 the base region when considering pointers. Treat pointers to 8828 decls as being non-heap. 8829 8830 2020-09-18 David Malcolm <dmalcolm (a] redhat.com> 8831 8832 * checker-path.cc (warning_event::get_desc): Handle global state 8833 changes. 8834 8835 2020-09-18 David Malcolm <dmalcolm (a] redhat.com> 8836 8837 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and 8838 strndup as being malloc-like allocators. 8839 8840 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8841 8842 * engine.cc (strongly_connected_components::strong_connect): Only 8843 consider intraprocedural edges when creating SCCs. 8844 (worklist::key_t::cmp): Add comment. Treat call_string 8845 differences as more important than differences of program_point 8846 within a supernode. 8847 8848 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8849 8850 * engine.cc (supernode_cluster::dump_dot): Show the SCC id 8851 in the per-supernode clusters in FILENAME.eg.dot output. 8852 (exploded_graph_annotator::add_node_annotations): 8853 Show the SCC of the supernode in FILENAME.supernode.eg.dot output. 8854 * exploded-graph.h (worklist::scc_id): New. 8855 (exploded_graph::get_scc_id): New. 8856 8857 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8858 8859 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED. 8860 (exploded_graph::process_worklist): Call 8861 maybe_process_run_of_before_supernode_enodes. 8862 (exploded_graph::maybe_process_run_of_before_supernode_enodes): 8863 New. 8864 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED. 8865 * exploded-graph.h (enum exploded_node::status): Add 8866 STATUS_BULK_MERGED. 8867 8868 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8869 8870 * engine.cc 8871 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>: 8872 Simplify by using program_point::get_next. 8873 * program-point.cc (program_point::get_next): New. 8874 * program-point.h (program_point::get_next): New decl. 8875 8876 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8877 8878 * engine.cc (exploded_graph::get_or_create_node): Show the 8879 program point when issuing -Wanalyzer-too-complex due to hitting 8880 the per-program-point limit. 8881 8882 2020-09-16 David Malcolm <dmalcolm (a] redhat.com> 8883 8884 * region-model.cc (region_model::on_call_pre): Treat getchar as 8885 having no side-effects. 8886 8887 2020-09-15 David Malcolm <dmalcolm (a] redhat.com> 8888 8889 PR analyzer/96650 8890 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace 8891 assertion that add_constraint succeeded with an assertion that 8892 if it fails, -fanalyzer-transitivity is off. 8893 8894 2020-09-14 David Malcolm <dmalcolm (a] redhat.com> 8895 8896 * analyzer.opt (-param=analyzer-max-constraints=): New param. 8897 * constraint-manager.cc 8898 (constraint_manager::add_constraint_internal): Silently reject 8899 attempts to add constraints when the above limit is reached. 8900 8901 2020-09-14 David Malcolm <dmalcolm (a] redhat.com> 8902 8903 PR analyzer/96653 8904 * constraint-manager.cc 8905 (constraint_manager::get_or_add_equiv_class): Don't accumulate 8906 transitive closure of all constraints on constants. 8907 8908 2020-09-14 David Malcolm <dmalcolm (a] redhat.com> 8909 8910 PR analyzer/97029 8911 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a 8912 pointer. 8913 * region-model.cc (region_model::deref_rvalue): Assert that the 8914 svalue is of pointer type. 8915 8916 2020-09-11 David Malcolm <dmalcolm (a] redhat.com> 8917 8918 PR analyzer/96798 8919 * region-model-impl-calls.cc (region_model::impl_call_memcpy): 8920 New. 8921 (region_model::impl_call_strcpy): New. 8922 * region-model.cc (region_model::on_call_pre): Flag unhandled 8923 builtins that are non-pure as having unknown side-effects. 8924 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY, 8925 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, 8926 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC, 8927 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED, 8928 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF, 8929 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR, 8930 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED, 8931 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF. 8932 * region-model.h (region_model::impl_call_memcpy): New decl. 8933 (region_model::impl_call_strcpy): New decl. 8934 8935 2020-09-09 David Malcolm <dmalcolm (a] redhat.com> 8936 8937 PR analyzer/94355 8938 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning. 8939 * region-model-impl-calls.cc 8940 (region_model::impl_call_operator_new): New. 8941 (region_model::impl_call_operator_delete): New. 8942 * region-model.cc (region_model::on_call_pre): Detect operator new 8943 and operator delete. 8944 (region_model::on_call_post): Likewise. 8945 (region_model::maybe_update_for_edge): Detect EH edges and call... 8946 (region_model::apply_constraints_for_exception): New function. 8947 * region-model.h (region_model::impl_call_operator_new): New decl. 8948 (region_model::impl_call_operator_delete): New decl. 8949 (region_model::apply_constraints_for_exception): New decl. 8950 * sm-malloc.cc (enum resource_state): New. 8951 (struct allocation_state): New state subclass. 8952 (enum wording): New. 8953 (struct api): New. 8954 (malloc_state_machine::custom_data_t): New typedef. 8955 (malloc_state_machine::add_state): New decl. 8956 (malloc_state_machine::m_unchecked) 8957 (malloc_state_machine::m_nonnull) 8958 (malloc_state_machine::m_freed): Delete these states in favor 8959 of... 8960 (malloc_state_machine::m_malloc) 8961 (malloc_state_machine::m_scalar_new) 8962 (malloc_state_machine::m_vector_new): ...this new api instances, 8963 which own their own versions of these states. 8964 (malloc_state_machine::on_allocator_call): New decl. 8965 (malloc_state_machine::on_deallocator_call): New decl. 8966 (api::api): New ctor. 8967 (dyn_cast_allocation_state): New. 8968 (as_a_allocation_state): New. 8969 (get_rs): New. 8970 (unchecked_p): New. 8971 (nonnull_p): New. 8972 (freed_p): New. 8973 (malloc_diagnostic::describe_state_change): Use unchecked_p and 8974 nonnull_p. 8975 (class mismatching_deallocation): New. 8976 (double_free::double_free): Add funcname param for initializing 8977 m_funcname. 8978 (double_free::emit): Use m_funcname in warning message rather 8979 than hardcoding "free". 8980 (double_free::describe_state_change): Likewise. Use freed_p. 8981 (double_free::describe_call_with_state): Use freed_p. 8982 (double_free::describe_final_event): Use m_funcname in message 8983 rather than hardcoding "free". 8984 (double_free::m_funcname): New field. 8985 (possible_null::describe_state_change): Use unchecked_p. 8986 (possible_null::describe_return_of_state): Likewise. 8987 (use_after_free::use_after_free): Add param for initializing m_api. 8988 (use_after_free::emit): Use m_api->m_dealloc_funcname in message 8989 rather than hardcoding "free". 8990 (use_after_free::describe_state_change): Use freed_p. Change the 8991 wording of the message based on the API. 8992 (use_after_free::describe_final_event): Use 8993 m_api->m_dealloc_funcname in message rather than hardcoding 8994 "free". Change the wording of the message based on the API. 8995 (use_after_free::m_api): New field. 8996 (malloc_leak::describe_state_change): Use unchecked_p. Update 8997 for renaming of m_malloc_event to m_alloc_event. 8998 (malloc_leak::describe_final_event): Update for renaming of 8999 m_malloc_event to m_alloc_event. 9000 (malloc_leak::m_malloc_event): Rename... 9001 (malloc_leak::m_alloc_event): ...to this. 9002 (free_of_non_heap::free_of_non_heap): Add param for initializing 9003 m_funcname. 9004 (free_of_non_heap::emit): Use m_funcname in message rather than 9005 hardcoding "free". 9006 (free_of_non_heap::describe_final_event): Likewise. 9007 (free_of_non_heap::m_funcname): New field. 9008 (allocation_state::dump_to_pp): New. 9009 (allocation_state::get_nonnull): New. 9010 (malloc_state_machine::malloc_state_machine): Update for changes 9011 to state fields and new api fields. 9012 (malloc_state_machine::add_state): New. 9013 (malloc_state_machine::on_stmt): Move malloc/calloc handling to 9014 on_allocator_call and call it, passing in the API pointer. 9015 Likewise for free, moving it to on_deallocator_call. Handle calls 9016 to operator new and delete in an analogous way. Use unchecked_p 9017 when testing for possibly-null-arg and possibly-null-deref, and 9018 transition to the non-null for the correct API. Remove redundant 9019 node param from call to on_zero_assignment. Use freed_p for 9020 use-after-free check, and pass in API. 9021 (malloc_state_machine::on_allocator_call): New, based on code in 9022 on_stmt. 9023 (malloc_state_machine::on_deallocator_call): Likewise. 9024 (malloc_state_machine::on_phi): Mark node param with 9025 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment. 9026 (malloc_state_machine::on_condition): Mark node param with 9027 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and 9028 set_next_state pairs, transitioning to the non-null state for the 9029 appropriate API. 9030 (malloc_state_machine::can_purge_p): Port to new state approach. 9031 (malloc_state_machine::on_zero_assignment): Replace on_transition 9032 calls with get_state and set_next_state pairs. Drop redundant 9033 node param. 9034 * sm.h (state_machine::add_custom_state): New. 9035 9036 2020-09-09 David Malcolm <dmalcolm (a] redhat.com> 9037 9038 * diagnostic-manager.cc 9039 (null_assignment_sm_context::warn_for_state): Replace with... 9040 (null_assignment_sm_context::warn): ...this. 9041 * engine.cc (impl_sm_context::warn_for_state): Replace with... 9042 (impl_sm_context::warn): ...this. 9043 * sm-file.cc (fileptr_state_machine::on_stmt): Replace 9044 warn_for_state and on_transition calls with a get_state 9045 test guarding warn and set_next_state calls. 9046 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise. 9047 * sm-pattern-test.cc (pattern_test_state_machine::on_condition): 9048 Replace warn_for_state call with warn call. 9049 * sm-sensitive.cc 9050 (sensitive_state_machine::warn_for_any_exposure): Replace 9051 warn_for_state call with a get_state test guarding a warn call. 9052 * sm-signal.cc (signal_state_machine::on_stmt): Likewise. 9053 * sm-taint.cc (taint_state_machine::on_stmt): Replace 9054 warn_for_state and on_transition calls with a get_state 9055 test guarding warn and set_next_state calls. 9056 * sm.h (sm_context::warn_for_state): Replace with... 9057 (sm_context::warn): ...this. 9058 9059 2020-09-09 David Malcolm <dmalcolm (a] redhat.com> 9060 9061 * diagnostic-manager.cc 9062 (null_assignment_sm_context::null_assignment_sm_context): Add old_state 9063 and ext_state params, initializing m_old_state and m_ext_state. 9064 (null_assignment_sm_context::on_transition): Split into... 9065 (null_assignment_sm_context::get_state): ...this new vfunc 9066 implementation and... 9067 (null_assignment_sm_context::set_next_state): ...this new vfunc 9068 implementation. 9069 (null_assignment_sm_context::m_old_state): New field. 9070 (null_assignment_sm_context::m_ext_state): New field. 9071 (diagnostic_manager::add_events_for_eedge): Pass in old state and 9072 ext_state when creating sm_ctxt. 9073 * engine.cc (impl_sm_context::on_transition): Split into... 9074 (impl_sm_context::get_state): ...this new vfunc 9075 implementation and... 9076 (impl_sm_context::set_next_state): ...this new vfunc 9077 implementation. 9078 * sm.h (sm_context::get_state): New pure virtual function. 9079 (sm_context::set_next_state): Likewise. 9080 (sm_context::on_transition): Convert from a pure virtual function 9081 to a regular function implemented in terms of get_state and 9082 set_next_state. 9083 9084 2020-09-09 David Malcolm <dmalcolm (a] redhat.com> 9085 9086 * checker-path.cc (state_change_event::get_desc): Update 9087 state_machine::get_state_name calls to state::get_name. 9088 (warning_event::get_desc): Likewise. 9089 * diagnostic-manager.cc 9090 (null_assignment_sm_context::on_transition): Update comparison 9091 against 0 with comparison with m_sm.get_start_state. 9092 (diagnostic_manager::prune_for_sm_diagnostic): Update 9093 state_machine::get_state_name calls to state::get_name. 9094 * engine.cc (impl_sm_context::on_transition): Likewise. 9095 (exploded_node::get_dot_fillcolor): Use get_id when summing 9096 the sm states. 9097 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode 9098 0 as the start state when initializing m_global_state. 9099 (sm_state_map::print): Use dump_to_pp rather than get_state_name 9100 when dumping states. 9101 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state 9102 when examining m_global_state. 9103 (sm_state_map::hash): Use get_id when hashing states. 9104 (selftest::test_sm_state_map): Use state objects rather than 9105 arbitrary hardcoded integers. 9106 (selftest::test_program_state_merging): Likewise. 9107 (selftest::test_program_state_merging_2): Likewise. 9108 * sm-file.cc (fileptr_state_machine::m_start): Move to base class. 9109 (file_diagnostic::describe_state_change): Use get_start_state. 9110 (fileptr_state_machine::fileptr_state_machine): Drop m_start 9111 initialization. 9112 * sm-malloc.cc (malloc_state_machine::m_start): Move to base 9113 class. 9114 (malloc_diagnostic::describe_state_change): Use get_start_state. 9115 (possible_null::describe_state_change): Likewise. 9116 (malloc_state_machine::malloc_state_machine): Drop m_start 9117 initialization. 9118 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move 9119 to base class. 9120 (pattern_test_state_machine::pattern_test_state_machine): Drop 9121 m_start initialization. 9122 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base 9123 class. 9124 (sensitive_state_machine::sensitive_state_machine): Drop m_start 9125 initialization. 9126 * sm-signal.cc (signal_state_machine::m_start): Move to base 9127 class. 9128 (signal_state_machine::signal_state_machine): Drop m_start 9129 initialization. 9130 * sm-taint.cc (taint_state_machine::m_start): Move to base class. 9131 (taint_state_machine::taint_state_machine): Drop m_start 9132 initialization. 9133 * sm.cc (state_machine::state::dump_to_pp): New. 9134 (state_machine::state_machine): Move here from sm.h. Initialize 9135 m_next_state_id and m_start. 9136 (state_machine::add_state): Reimplement in terms of state objects. 9137 (state_machine::get_state_name): Delete. 9138 (state_machine::get_state_by_name): Reimplement in terms of state 9139 objects. Make const. 9140 (state_machine::validate): Delete. 9141 (state_machine::dump_to_pp): Reimplement in terms of state 9142 objects. 9143 * sm.h (state_machine::state): New class. 9144 (state_machine::state_t): Convert typedef from "unsigned" to 9145 "const state_machine::state *". 9146 (state_machine::state_machine): Move to sm.cc. 9147 (state_machine::get_default_state): Use m_start rather than 9148 hardcoding 0. 9149 (state_machine::get_state_name): Delete. 9150 (state_machine::get_state_by_name): Make const. 9151 (state_machine::get_start_state): New accessor. 9152 (state_machine::alloc_state_id): New. 9153 (state_machine::m_state_names): Drop in favor of... 9154 (state_machine::m_states): New field 9155 (state_machine::m_start): New field 9156 (start_start_p): Delete. 9157 9158 2020-09-08 David Malcolm <dmalcolm (a] redhat.com> 9159 9160 PR analyzer/96949 9161 * store.cc (binding_map::apply_ctor_val_to_range): Add 9162 error-handling for the cases where we have symbolic offsets. 9163 9164 2020-09-08 David Malcolm <dmalcolm (a] redhat.com> 9165 9166 PR analyzer/96950 9167 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR 9168 where min_index == max_index. 9169 (binding_map::apply_ctor_val_to_range): Replace assertion that we 9170 don't have a CONSTRUCTOR value with error-handling. 9171 9172 2020-09-08 David Malcolm <dmalcolm (a] redhat.com> 9173 9174 PR analyzer/96962 9175 * region-model.cc (region_model::on_call_pre): Fix guard on switch 9176 on built-ins to only consider BUILT_IN_NORMAL, rather than other 9177 kinds of build-ins. 9178 9179 2020-09-01 David Malcolm <dmalcolm (a] redhat.com> 9180 9181 PR analyzer/96792 9182 * region-model.cc (region_model::deref_rvalue): Add the constraint 9183 that PTR_SVAL is non-NULL. 9184 9185 2020-08-31 David Malcolm <dmalcolm (a] redhat.com> 9186 9187 PR analyzer/96798 9188 * region-model.cc (region_model::on_call_pre): Handle 9189 BUILT_IN_MEMSET_CHK. 9190 9191 2020-08-31 David Malcolm <dmalcolm (a] redhat.com> 9192 9193 * region-model.cc (region_model::on_call_pre): Gather handling of 9194 builtins and of internal fns into switch statements. Handle 9195 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN. 9196 9197 2020-08-31 David Malcolm <dmalcolm (a] redhat.com> 9198 9199 PR analyzer/96860 9200 * region.cc (decl_region::get_svalue_for_constructor): Support 9201 apply_ctor_to_region failing. 9202 * store.cc (binding_map::apply_ctor_to_region): Add failure 9203 handling. 9204 (binding_map::apply_ctor_val_to_range): Likewise. 9205 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace 9206 assertion that child_base_offset is not symbolic with error 9207 handling. 9208 * store.h (binding_map::apply_ctor_to_region): Convert return type 9209 from void to bool. 9210 (binding_map::apply_ctor_val_to_range): Likewise. 9211 (binding_map::apply_ctor_pair_to_child_region): Likewise. 9212 9213 2020-08-31 David Malcolm <dmalcolm (a] redhat.com> 9214 9215 PR analyzer/96763 9216 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR 9217 by calling a new binding_map::apply_ctor_val_to_range subroutine. 9218 Split out the existing non-CONSTRUCTOR-handling code to a new 9219 apply_ctor_pair_to_child_region subroutine. 9220 (binding_map::apply_ctor_val_to_range): New. 9221 (binding_map::apply_ctor_pair_to_child_region): New, split out 9222 from binding_map::apply_ctor_to_region as noted above. 9223 * store.h (binding_map::apply_ctor_val_to_range): New decl. 9224 (binding_map::apply_ctor_pair_to_child_region): New decl. 9225 9226 2020-08-31 David Malcolm <dmalcolm (a] redhat.com> 9227 9228 PR analyzer/96764 9229 * region-model-manager.cc 9230 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR. 9231 (region_model_manager::get_or_create_cast): Move logic for 9232 real->integer casting to... 9233 (get_code_for_cast): ...this new function, and add logic for 9234 real->non-integer casts. 9235 (region_model_manager::maybe_fold_sub_svalue): Handle 9236 VIEW_CONVERT_EXPR. 9237 * region-model.cc 9238 (region_model::add_any_constraints_from_gassign): Likewise. 9239 * svalue.cc (svalue::maybe_undo_cast): Likewise. 9240 (unaryop_svalue::dump_to_pp): Likewise. 9241 9242 2020-08-26 David Malcolm <dmalcolm (a] redhat.com> 9243 9244 PR analyzer/94858 9245 * region-model-manager.cc 9246 (region_model_manager::get_or_create_widening_svalue): Assert that 9247 neither of the inputs are themselves widenings. 9248 * store.cc (store::eval_alias_1): The initial value of a pointer 9249 can't point to a region that was allocated on the heap after the 9250 beginning of the path. A widened pointer value can't alias anything 9251 that the initial pointer value can't alias. 9252 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X 9253 to a widening svalue. Merge 9254 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to 9255 to the LHS of the first BINOP. 9256 9257 2020-08-26 David Malcolm <dmalcolm (a] redhat.com> 9258 9259 PR analyzer/96777 9260 * region-model.h (class compound_svalue): Document that all keys 9261 must be concrete. 9262 (compound_svalue::compound_svalue): Move definition to svalue.cc. 9263 * store.cc (binding_map::apply_ctor_to_region): Handle 9264 initializers for trailing arrays with incomplete size. 9265 * svalue.cc (compound_svalue::compound_svalue): Move definition 9266 here from region-model.h. Add assertion that all keys are 9267 concrete. 9268 9269 2020-08-22 David Malcolm <dmalcolm (a] redhat.com> 9270 9271 PR analyzer/94851 9272 * region-model-manager.cc 9273 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0. 9274 9275 2020-08-22 David Malcolm <dmalcolm (a] redhat.com> 9276 9277 * store.cc (store::eval_alias): Make const. Split out 2nd half 9278 into store::eval_alias_1 and call it twice for symmetry, avoiding 9279 test duplication. 9280 (store::eval_alias_1): New function, split out from the above. 9281 * store.h (store::eval_alias): Make const. 9282 (store::eval_alias_1): New decl. 9283 9284 2020-08-22 David Malcolm <dmalcolm (a] redhat.com> 9285 9286 * region-model.cc (region_model::push_frame): Bind the default 9287 SSA name for each parm if it exists, falling back to the parm 9288 itself otherwise, rather than doing both. 9289 9290 2020-08-20 David Malcolm <dmalcolm (a] redhat.com> 9291 9292 PR analyzer/96723 9293 * region-model-manager.cc 9294 (region_model_manager::get_field_region): Assert that field is a 9295 FIELD_DECL. 9296 * region.cc (region::get_subregions_for_binding): In 9297 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs. 9298 9299 2020-08-20 David Malcolm <dmalcolm (a] redhat.com> 9300 9301 PR analyzer/96713 9302 * region-model.cc (region_model::get_gassign_result): For 9303 comparisons, only use eval_condition when the lhs has boolean 9304 type, and use get_or_create_constant_svalue on the boolean 9305 constants directly rather than via get_rvalue. 9306 9307 2020-08-19 David Malcolm <dmalcolm (a] redhat.com> 9308 9309 PR analyzer/96643 9310 * region-model.cc (region_model::deref_rvalue): Rather than 9311 attempting to handle all svalue kinds in the switch, only cover 9312 the special cases, and move symbolic-region handling to after 9313 the switch, thus implicitly handling the missing case SK_COMPOUND. 9314 9315 2020-08-19 David Malcolm <dmalcolm (a] redhat.com> 9316 9317 PR analyzer/96705 9318 * region-model-manager.cc 9319 (region_model_manager::maybe_fold_binop): Check that we have an 9320 integral type before calling build_int_cst. 9321 9322 2020-08-19 David Malcolm <dmalcolm (a] redhat.com> 9323 9324 PR analyzer/96699 9325 * region-model-manager.cc 9326 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for 9327 casting from REAL_TYPE to INTEGER_TYPE. 9328 9329 2020-08-19 David Malcolm <dmalcolm (a] redhat.com> 9330 9331 PR analyzer/96651 9332 * region-model.cc (region_model::called_from_main_p): New. 9333 (region_model::get_store_value): Move handling for globals into... 9334 (region_model::get_initial_value_for_global): ...this new 9335 function, and add logic for extracting values from decl 9336 initializers. 9337 * region-model.h (decl_region::get_svalue_for_constructor): New 9338 decl. 9339 (decl_region::get_svalue_for_initializer): New decl. 9340 (region_model::called_from_main_p): New decl. 9341 (region_model::get_initial_value_for_global): New. 9342 * region.cc (decl_region::maybe_get_constant_value): Move logic 9343 for getting an svalue from a CONSTRUCTOR node to... 9344 (decl_region::get_svalue_for_constructor): ...this new function. 9345 (decl_region::get_svalue_for_initializer): New. 9346 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of 9347 region_model::get_rvalue. 9348 * store.h (binding_cluster::get_map): New accessor. 9349 9350 2020-08-19 David Malcolm <dmalcolm (a] redhat.com> 9351 9352 PR analyzer/96648 9353 * region.cc (get_field_at_bit_offset): Gracefully handle negative 9354 values for bit_offset. 9355 9356 2020-08-18 David Malcolm <dmalcolm (a] redhat.com> 9357 9358 * region-model.cc (region_model::get_rvalue_1): Fix name of local. 9359 9360 2020-08-18 David Malcolm <dmalcolm (a] redhat.com> 9361 9362 PR analyzer/96641 9363 * region-model.cc (region_model::get_rvalue_1): Handle 9364 unrecognized tree codes by returning "UNKNOWN. 9365 9366 2020-08-18 David Malcolm <dmalcolm (a] redhat.com> 9367 9368 PR analyzer/96640 9369 * region-model.cc (region_model::get_gassign_result): Handle various 9370 VEC_* tree codes by returning UNKNOWN. 9371 (region_model::on_assignment): Handle unrecognized tree codes by 9372 setting lhs to an unknown value, rather than issuing a "sorry" and 9373 asserting. 9374 9375 2020-08-17 David Malcolm <dmalcolm (a] redhat.com> 9376 9377 PR analyzer/96644 9378 * region-model-manager.cc (get_region_for_unexpected_tree_code): 9379 Handle ctxt being NULL. 9380 9381 2020-08-17 David Malcolm <dmalcolm (a] redhat.com> 9382 9383 PR analyzer/96639 9384 * region.cc (region::get_subregions_for_binding): Check for "type" 9385 being NULL. 9386 9387 2020-08-17 David Malcolm <dmalcolm (a] redhat.com> 9388 9389 PR analyzer/96642 9390 * store.cc (get_svalue_for_ctor_val): New. 9391 (binding_map::apply_ctor_to_region): Call it. 9392 9393 2020-08-14 David Malcolm <dmalcolm (a] redhat.com> 9394 9395 PR testsuite/96609 9396 PR analyzer/96616 9397 * region-model.cc (region_model::get_store_value): Call 9398 maybe_get_constant_value on decl_regions first. 9399 * region-model.h (decl_region::maybe_get_constant_value): New decl. 9400 * region.cc (decl_region::get_stack_depth): Likewise. 9401 (decl_region::maybe_get_constant_value): New. 9402 * store.cc (get_subregion_within_ctor): New. 9403 (binding_map::apply_ctor_to_region): New. 9404 * store.h (binding_map::apply_ctor_to_region): New decl. 9405 9406 2020-08-14 David Malcolm <dmalcolm (a] redhat.com> 9407 9408 PR analyzer/96611 9409 * store.cc (store::mark_as_escaped): Reject attempts to 9410 get a cluster for an unknown pointer. 9411 9412 2020-08-13 David Malcolm <dmalcolm (a] redhat.com> 9413 9414 PR analyzer/93032 9415 PR analyzer/93938 9416 PR analyzer/94011 9417 PR analyzer/94099 9418 PR analyzer/94399 9419 PR analyzer/94458 9420 PR analyzer/94503 9421 PR analyzer/94640 9422 PR analyzer/94688 9423 PR analyzer/94689 9424 PR analyzer/94839 9425 PR analyzer/95026 9426 PR analyzer/95042 9427 PR analyzer/95240 9428 * analyzer-logging.cc: Ignore "-Wformat-diag". 9429 (logger::enter_scope): Use inc_indent in both overloads. 9430 (logger::exit_scope): Use dec_indent. 9431 * analyzer-logging.h (logger::inc_indent): New. 9432 (logger::dec_indent): New. 9433 * analyzer-selftests.cc (run_analyzer_selftests): Call 9434 analyzer_store_cc_tests. 9435 * analyzer-selftests.h (analyzer_store_cc_tests): New decl. 9436 * analyzer.cc (get_stmt_location): New function. 9437 * analyzer.h (class initial_svalue): New forward decl. 9438 (class unaryop_svalue): New forward decl. 9439 (class binop_svalue): New forward decl. 9440 (class sub_svalue): New forward decl. 9441 (class unmergeable_svalue): New forward decl. 9442 (class placeholder_svalue): New forward decl. 9443 (class widening_svalue): New forward decl. 9444 (class compound_svalue): New forward decl. 9445 (class conjured_svalue): New forward decl. 9446 (svalue_set): New typedef. 9447 (class map_region): Delete. 9448 (class array_region): Delete. 9449 (class frame_region): New forward decl. 9450 (class function_region): New forward decl. 9451 (class label_region): New forward decl. 9452 (class decl_region): New forward decl. 9453 (class element_region): New forward decl. 9454 (class offset_region): New forward decl. 9455 (class cast_region): New forward decl. 9456 (class field_region): New forward decl. 9457 (class string_region): New forward decl. 9458 (class region_model_manager): New forward decl. 9459 (class store_manager): New forward decl. 9460 (class store): New forward decl. 9461 (class call_details): New forward decl. 9462 (struct svalue_id_merger_mapping): Delete. 9463 (struct canonicalization): Delete. 9464 (class function_point): New forward decl. 9465 (class engine): New forward decl. 9466 (dump_tree): New function decl. 9467 (print_quoted_type): New function decl. 9468 (readability_comparator): New function decl. 9469 (tree_cmp): New function decl. 9470 (class path_var): Move here from region-model.h 9471 (bit_offset_t, bit_size_t, byte_size_t): New typedefs. 9472 (class region_offset): New class. 9473 (get_stmt_location): New decl. 9474 (struct member_function_hash_traits): New struct. 9475 (class consolidation_map): New class. 9476 Ignore "-Wformat-diag". 9477 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param. 9478 (-param=analyzer-max-enodes-for-full-dump=): New param. 9479 * call-string.cc: Ignore -Wformat-diag. 9480 * checker-path.cc: Move includes of "analyzer/call-string.h" and 9481 "analyzer/program-point.h" to before "analyzer/region-model.h", 9482 and also include "analyzer/store.h" before it. 9483 (state_change_event::state_change_event): Replace "tree var" param 9484 with "const svalue *sval". Convert "origin" param from tree to 9485 "const svalue *". 9486 (state_change_event::get_desc): Call get_representative_tree to 9487 convert the var and origin from const svalue * to tree. Use 9488 svalue::get_desc rather than %qE when describing state changes. 9489 (checker_path::add_final_event): Use get_stmt_location. 9490 * checker-path.h (state_change_event::state_change_event): Port 9491 from tree to const svalue *. 9492 (state_change_event::get_lvalue): Delete. 9493 (state_change_event::get_dest_function): New. 9494 (state_change_event::m_var): Replace with... 9495 (state_change_event::m_sval): ...this. 9496 (state_change_event::m_origin): Convert from tree to 9497 const svalue *. 9498 * constraint-manager.cc: Include "analyzer/call-string.h", 9499 "analyzer/program-point.h", and "analyzer/store.h" before 9500 "analyzer/region-model.h". 9501 (struct bound, struct range): Move to constraint-manager.h. 9502 (compare_constants): New function. 9503 (range::dump): Rename to... 9504 (range::dump_to_pp): ...this. Support NULL constants. 9505 (range::dump): Reintroduce for dumping to stderr. 9506 (range::constrained_to_single_element): Return result, rather than 9507 writing to *OUT. 9508 (range::eval_condition): New. 9509 (range::below_lower_bound): New. 9510 (range::above_upper_bound): New. 9511 (equiv_class::equiv_class): Port from svalue_id to const svalue *. 9512 (equiv_class::print): Likewise. 9513 (equiv_class::hash): Likewise. 9514 (equiv_class::operator==): Port from svalue_id to const svalue *. 9515 (equiv_class::add): Port from svalue_id to const svalue *. Drop 9516 "cm" param. 9517 (equiv_class::del): Port from svalue_id to const svalue *. 9518 (equiv_class::get_representative): Likewise. 9519 (equiv_class::remap_svalue_ids): Delete. 9520 (svalue_id_cmp_by_id): Rename to... 9521 (svalue_cmp_by_ptr): ...this, porting from svalue_id to 9522 const svalue *. 9523 (equiv_class::canonicalize): Update qsort comparator. 9524 (constraint::implied_by): New. 9525 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor. 9526 (constraint_manager::dump_to_pp): Add "multiline" param 9527 (constraint_manager::dump): Pass "true" for "multiline". 9528 (constraint_manager::add_constraint): Port from svalue_id to 9529 const svalue *. Split out second part into... 9530 (constraint_manager::add_unknown_constraint): ...this new 9531 function. Remove self-constraints when merging equivalence 9532 classes. 9533 (constraint_manager::add_constraint_internal): Remove constraints 9534 that would be implied by the new constraint. Port from svalue_id 9535 to const svalue *. 9536 (constraint_manager::get_equiv_class_by_sid): Rename to... 9537 (constraint_manager::get_equiv_class_by_svalue): ...this, porting 9538 from svalue_id to const svalue *. 9539 (constraint_manager::get_or_add_equiv_class): Port from svalue_id 9540 to const svalue *. 9541 (constraint_manager::eval_condition): Make const. Call 9542 compare_constants and return early if it provides a known result. 9543 (constraint_manager::get_ec_bounds): New. 9544 (constraint_manager::eval_condition): New overloads. Make 9545 existing one const, and use compare_constants. 9546 (constraint_manager::purge): Convert "p" param to a template 9547 rather that an abstract base class. Port from svalue_id to 9548 const svalue *. 9549 (class dead_svalue_purger): New class. 9550 (constraint_manager::remap_svalue_ids): Delete. 9551 (constraint_manager::on_liveness_change): New. 9552 (equiv_class_cmp): Port from svalue_id to const svalue *. 9553 (constraint_manager::canonicalize): Likewise. Combine with 9554 purging of redundant equivalence classes and constraints. 9555 (class cleaned_constraint_manager): Delete. 9556 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger" 9557 field. 9558 (merger_fact_visitor::fact): Port from svalue_id to const svalue *. 9559 Add special case for widening. 9560 (constraint_manager::merge): Port from svalue_id to const svalue *. 9561 (constraint_manager::clean_merger_input): Delete. 9562 (constraint_manager::for_each_fact): Port from svalue_id to 9563 const svalue *. 9564 (constraint_manager::validate): Likewise. 9565 (selftest::test_constraint_conditions): Provide a 9566 region_model_manager when creating region_model instances. 9567 Add test for self-equality not creating equivalence classes. 9568 (selftest::test_transitivity): Provide a region_model_manager when 9569 creating region_model instances. Verify that EC-merging happens 9570 when constraints are implied. 9571 (selftest::test_constant_comparisons): Provide a 9572 region_model_manager when creating region_model instances. 9573 (selftest::test_constraint_impl): Likewise. Remove over-specified 9574 assertions. 9575 (selftest::test_equality): Provide a region_model_manager when 9576 creating region_model instances. 9577 (selftest::test_many_constants): Likewise. Provide a 9578 program_point when testing merging. 9579 (selftest::run_constraint_manager_tests): Move call to 9580 test_constant_comparisons to outside the transitivity guard. 9581 * constraint-manager.h (struct bound): Move here from 9582 constraint-manager.cc. 9583 (struct range): Likewise. 9584 (struct::eval_condition): New decl. 9585 (struct::below_lower_bound): New decl. 9586 (struct::above_upper_bound): New decl. 9587 (equiv_class::add): Port from svalue_id to const svalue *. 9588 (equiv_class::del): Likewise. 9589 (equiv_class::get_representative): Likewise. 9590 (equiv_class::remap_svalue_ids): Drop. 9591 (equiv_class::m_cst_sid): Convert to.. 9592 (equiv_class::m_cst_sval): ...this. 9593 (equiv_class::m_vars): Port from svalue_id to const svalue *. 9594 (constraint::bool implied_by): New decl. 9595 (fact_visitor::on_fact): Port from svalue_id to const svalue *. 9596 (constraint_manager::constraint_manager): Add mgr param. 9597 (constraint_manager::clone): Delete. 9598 (constraint_manager::maybe_get_constant): Delete. 9599 (constraint_manager::get_sid_for_constant): Delete. 9600 (constraint_manager::get_num_svalues): Delete. 9601 (constraint_manager::dump_to_pp): Add "multiline" param. 9602 (constraint_manager::get_equiv_class): Port from svalue_id to 9603 const svalue *. 9604 (constraint_manager::add_constraint): Likewise. 9605 (constraint_manager::get_equiv_class_by_sid): Rename to... 9606 (constraint_manager::get_equiv_class_by_svalue): ...this, porting 9607 from svalue_id to const svalue *. 9608 (constraint_manager::add_unknown_constraint): New decl. 9609 (constraint_manager::get_or_add_equiv_class): Port from svalue_id 9610 to const svalue *. 9611 (constraint_manager::eval_condition): Likewise. Add overloads. 9612 (constraint_manager::get_ec_bounds): New decl. 9613 (constraint_manager::purge): Convert to template. 9614 (constraint_manager::remap_svalue_ids): Delete. 9615 (constraint_manager::on_liveness_change): New decl. 9616 (constraint_manager::canonicalize): Drop param. 9617 (constraint_manager::clean_merger_input): Delete. 9618 (constraint_manager::m_mgr): New field. 9619 * diagnostic-manager.cc: Move includes of 9620 "analyzer/call-string.h" and "analyzer/program-point.h" to before 9621 "analyzer/region-model.h", and also include "analyzer/store.h" 9622 before it. 9623 (saved_diagnostic::saved_diagnostic): Add "sval" param. 9624 (diagnostic_manager::diagnostic_manager): Add engine param. 9625 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it 9626 to saved_diagnostic ctor. Update overload to pass NULL for it. 9627 (dedupe_winners::dedupe_winners): Add engine param. 9628 (dedupe_winners::add): Add "eg" param. Pass m_engine to 9629 feasible_p. 9630 (dedupe_winner::m_engine): New field. 9631 (diagnostic_manager::emit_saved_diagnostics): Pass engine to 9632 dedupe_winners. Pass &eg when adding candidates. Pass svalue 9633 rather than tree to prune_path. Use get_stmt_location to get 9634 primary location of diagnostic. 9635 (diagnostic_manager::emit_saved_diagnostic): Likewise. 9636 (get_any_origin): Drop. 9637 (state_change_event_creator::on_global_state_change): Pass NULL 9638 const svalue * rather than NULL_TREE trees to state_change_event 9639 ctor. 9640 (state_change_event_creator::on_state_change): Port from tree and 9641 svalue_id to const svalue *. 9642 (for_each_state_change): Port from svalue_id to const svalue *. 9643 (struct null_assignment_sm_context): New. 9644 (diagnostic_manager::add_events_for_eedge): Add state change 9645 events for assignment to NULL. 9646 (diagnostic_manager::prune_path): Update param from tree to 9647 const svalue *. 9648 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking 9649 by tree to by const svalue *. 9650 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval 9651 param. 9652 (saved_diagnostic::m_sval): New field. 9653 (diagnostic_manager::diagnostic_manager): Add engine param. 9654 (diagnostic_manager::get_engine): New. 9655 (diagnostic_manager::add_diagnostic): Add "sval" param. 9656 (diagnostic_manager::prune_path): Likewise. 9657 (diagnostic_manager::prune_for_sm_diagnostic): New overload. 9658 (diagnostic_manager::m_eng): New field. 9659 * engine.cc: Move includes of "analyzer/call-string.h" and 9660 "analyzer/program-point.h" to before "analyzer/region-model.h", 9661 and also include "analyzer/store.h" before it. 9662 (impl_region_model_context::impl_region_model_context): Update for 9663 removal of m_change field. 9664 (impl_region_model_context::remap_svalue_ids): Delete. 9665 (impl_region_model_context::on_svalue_leak): New. 9666 (impl_region_model_context::on_svalue_purge): Delete. 9667 (impl_region_model_context::on_liveness_change): New. 9668 (impl_region_model_context::on_unknown_change): Update param 9669 from svalue_id to const svalue *. Add is_mutable param. 9670 (setjmp_svalue::compare_fields): Delete. 9671 (setjmp_svalue::accept): New. 9672 (setjmp_svalue::add_to_hash): Delete. 9673 (setjmp_svalue::dump_to_pp): New. 9674 (setjmp_svalue::print_details): Delete. 9675 (impl_sm_context::impl_sm_context): Drop "change" param. 9676 (impl_sm_context::get_fndecl_for_call): Drop "m_change". 9677 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from 9678 "stmt" param. Drop m_change. Port from svalue_id to 9679 const svalue *. 9680 (impl_sm_context::warn_for_state): Drop m_change. Port from 9681 svalue_id to const svalue *. 9682 (impl_sm_context::get_readable_tree): Rename to... 9683 (impl_sm_context::get_diagnostic_tree): ...this. Port from 9684 svalue_id to const svalue *. 9685 (impl_sm_context::is_zero_assignment): New. 9686 (impl_sm_context::m_change): Delete field. 9687 (leak_stmt_finder::find_stmt): Handle m_var being NULL. 9688 (readability): Increase penalty for MEM_REF. For SSA_NAMEs, 9689 slightly favor the underlying var over the SSA name. Heavily 9690 penalize temporaries. Handle RESULT_DECL. 9691 (readability_comparator): Make non-static. Consider stack depths. 9692 (impl_region_model_context::on_state_leak): Convert from svalue_id 9693 to const svalue *, updating for region_model changes. Use 9694 id_equal. 9695 (impl_region_model_context::on_inherited_svalue): Delete. 9696 (impl_region_model_context::on_cast): Delete. 9697 (impl_region_model_context::on_condition): Drop m_change. 9698 (impl_region_model_context::on_phi): Likewise. 9699 (impl_region_model_context::on_unexpected_tree_code): Handle t 9700 being NULL. 9701 (point_and_state::validate): Update stack checking for 9702 region_model changes. 9703 (eg_traits::dump_args_t::show_enode_details_p): New. 9704 (exploded_node::exploded_node): Initialize m_num_processed_stmts. 9705 (exploded_node::get_processed_stmt): New function. 9706 (exploded_node::get_dot_fillcolor): Add more colors. 9707 (exploded_node::dump_dot): Guard the printing of the point and 9708 state with show_enode_details_p. Print the processed stmts for 9709 this enode after the initial state. 9710 (exploded_node::dump_to_pp): Pass true for new multiline param 9711 of program_state::dump_to_pp. 9712 (exploded_node::on_stmt): Drop "change" param. Log the stmt. 9713 Set input_location. Implement __analyzer_describe. Update 9714 implementation of __analyzer_dump and __analyzer_eval. 9715 Remove purging of sm-state for unknown fncalls from here. 9716 (exploded_node::on_edge): Drop "change" param. 9717 (exploded_node::on_longjmp): Port from region_id/svalue_id to 9718 const region */const svalue *. Call program_state::detect_leaks. 9719 Drop state_change. 9720 (exploded_node::detect_leaks): Update for changes to region_model. 9721 Call program_state::detect_leaks. 9722 (exploded_edge::exploded_edge): Drop ext_state and change params. 9723 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping 9724 of m_change. 9725 (exploded_graph::exploded_graph): Pass engine to 9726 m_diagnostic_manager ctor. Use program_point::origin. 9727 (exploded_graph::add_function_entry): Drop ctxt. Use 9728 program_state::push_frame. Drop state_change. 9729 (exploded_graph::get_or_create_node): Drop "change" param. Add 9730 "enode_for_diag" param. Update dumping calls for API changes. 9731 Pass point to can_merge_with_p. Show enode indices 9732 within -Wanalyzer-too-complex diagnostic for hitting the per-point 9733 limit. 9734 (exploded_graph::add_edge): Drop "change" param. Log which nodes 9735 are being connected. Update for changes to exploded_edge ctor. 9736 (exploded_graph::get_per_program_point_data): New. 9737 (exploded_graph::process_worklist): Pass point to 9738 can_merge_with_p. Drop state_change. Update dumping call for API 9739 change. 9740 (exploded_graph::process_node): Drop state_change. Split the 9741 node in-place if an sm-state-change occurs. Update 9742 m_num_processed_stmts. Update dumping calls for API change. 9743 (exploded_graph::log_stats): Call engine::log_stats. 9744 (exploded_graph::dump_states_for_supernode): Update dumping 9745 call. 9746 (exploded_path::feasible_p): Add "eng" and "eg" params. 9747 Rename "i" to "end_idx". Pass the manager to the region_model 9748 ctor. Update for every processed stmt in the enode, not just the 9749 first. Keep track of which snodes have been visited, and call 9750 loop_replay_fixup when revisiting one. 9751 (enode_label::get_text): Update dump call for new param. 9752 (exploded_graph::dump_exploded_nodes): Likewise. 9753 (exploded_graph::get_node_by_index): New. 9754 (impl_run_checkers): Create engine instance and pass its address 9755 to extrinsic_state ctor. 9756 * exploded-graph.h 9757 (impl_region_model_context::impl_region_model_context): Drop 9758 "change" params. 9759 (impl_region_model_context::void remap_svalue_ids): Delete. 9760 (impl_region_model_context::on_svalue_purge): Delete. 9761 (impl_region_model_context::on_svalue_leak): New. 9762 (impl_region_model_context::on_liveness_change): New. 9763 (impl_region_model_context::on_state_leak): Update signature. 9764 (impl_region_model_context::on_inherited_svalue): Delete. 9765 (impl_region_model_context::on_cast): Delete. 9766 (impl_region_model_context::on_unknown_change): Update signature. 9767 (impl_region_model_context::m_change): Delete. 9768 (eg_traits::dump_args_t::show_enode_details_p): New. 9769 (exploded_node::on_stmt): Drop "change" param. 9770 (exploded_node::on_edge): Likewise. 9771 (exploded_node::get_processed_stmt): New decl. 9772 (exploded_node::m_num_processed_stmts): New field. 9773 (exploded_edge::exploded_edge): Drop ext_state and change params. 9774 (exploded_edge::m_change): Delete. 9775 (exploded_graph::get_engine): New accessor. 9776 (exploded_graph::get_or_create_node): Drop "change" param. Add 9777 "enode_for_diag" param. 9778 (exploded_graph::add_edge): Drop "change" param. 9779 (exploded_graph::get_per_program_point_data): New decl. 9780 (exploded_graph::get_node_by_index): New decl. 9781 (exploded_path::feasible_p): Add "eng" and "eg" params. 9782 * program-point.cc: Include "analyzer/store.h" before including 9783 "analyzer/region-model.h". 9784 (function_point::function_point): Move here from 9785 program-point.h. 9786 (function_point::get_function): Likewise. 9787 (function_point::from_function_entry): Likewise. 9788 (function_point::before_supernode): Likewise. 9789 (function_point::next_stmt): New function. 9790 * program-point.h (function_point::function_point): Move 9791 implementation from here to program-point.cc. 9792 (function_point::get_function): Likewise. 9793 (function_point::from_function_entry): Likewise. 9794 (function_point::before_supernode): Likewise. 9795 (function_point::next_stmt): New decl. 9796 (program_point::operator!=): New. 9797 (program_point::origin): New. 9798 (program_point::next_stmt): New. 9799 (program_point::m_function_point): Make non-const. 9800 * program-state.cc: Move includes of "analyzer/call-string.h" and 9801 "analyzer/program-point.h" to before "analyzer/region-model.h", 9802 and also include "analyzer/store.h" before it. 9803 (extrinsic_state::get_model_manager): New. 9804 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor, 9805 rather than pass the around. 9806 (sm_state_map::clone_with_remapping): Delete. 9807 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add 9808 "simple" and "multiline" params and support multiline vs single 9809 line dumping. 9810 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add 9811 "simple" param. 9812 (sm_state_map::hash): Port from svalue_id to const svalue *. 9813 (sm_state_map::operator==): Likewise. 9814 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on 9815 input. Handle inheritance of sm-state. Call get_default_state. 9816 (sm_state_map::get_origin): Port from svalue_id to const svalue *. 9817 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject 9818 attempts to set state on UNKNOWN. 9819 (sm_state_map::impl_set_state): Port from svalue_id to 9820 const svalue *. Pass in ext_state. Call canonicalize_svalue on 9821 input. 9822 (sm_state_map::purge_for_unknown_fncall): Delete. 9823 (sm_state_map::on_svalue_leak): New. 9824 (sm_state_map::remap_svalue_ids): Delete. 9825 (sm_state_map::on_liveness_change): New. 9826 (sm_state_map::on_unknown_change): Reimplement. 9827 (sm_state_map::on_svalue_purge): Delete. 9828 (sm_state_map::on_inherited_svalue): Delete. 9829 (sm_state_map::on_cast): Delete. 9830 (sm_state_map::validate): Delete. 9831 (sm_state_map::canonicalize_svalue): New. 9832 (program_state::program_state): Update to pass manager to 9833 region_model's ctor. Constify num_states and pass state machine 9834 and index to sm_state_map ctor. 9835 (program_state::print): Update for changes to dump API. 9836 (program_state::dump_to_pp): Ignore the summarize param. Add 9837 "multiline" param. 9838 (program_state::dump_to_file): Add "multiline" param. 9839 (program_state::dump): Pass "true" for new "multiline" param. 9840 (program_state::push_frame): New. 9841 (program_state::on_edge): Drop "change" param. Call 9842 program_state::detect_leaks. 9843 (program_state::prune_for_point): Add enode_for_diag param. 9844 Reimplement based on store class. Call detect_leaks 9845 (program_state::remap_svalue_ids): Delete. 9846 (program_state::get_representative_tree): Port from svalue_id to 9847 const svalue *. 9848 (program_state::can_merge_with_p): Add "point" param. Add early 9849 reject for sm-differences. Drop id remapping. 9850 (program_state::validate): Drop region model and sm_state_map 9851 validation. 9852 (state_change::sm_change::dump): Delete. 9853 (state_change::sm_change::remap_svalue_ids): Delete. 9854 (state_change::sm_change::on_svalue_purge): Delete. 9855 (log_set_of_svalues): New. 9856 (state_change::sm_change::validate): Delete. 9857 (state_change::state_change): Delete. 9858 (state_change::add_sm_change): Delete. 9859 (state_change::affects_p): Delete. 9860 (state_change::dump): Delete. 9861 (state_change::remap_svalue_ids): Delete. 9862 (state_change::on_svalue_purge): Delete. 9863 (state_change::validate): Delete. 9864 (selftest::assert_dump_eq): Delete. 9865 (ASSERT_DUMP_EQ): Delete. 9866 (selftest::test_sm_state_map): Update for changes to region_model 9867 and sm_state_map, porting from svalue_id to const svalue *. 9868 (selftest::test_program_state_dumping): Likewise. Drop test of 9869 dumping, renaming to... 9870 (selftest::test_program_state_1): ...this. 9871 (selftest::test_program_state_dumping_2): Likewise, renaming to... 9872 (selftest::test_program_state_2): ...this. 9873 (selftest::test_program_state_merging): Update for changes to 9874 region_model. 9875 (selftest::test_program_state_merging_2): Likewise. 9876 (selftest::analyzer_program_state_cc_tests): Update for renamed 9877 tests. 9878 * program-state.h (extrinsic_state::extrinsic_state): Add logger 9879 and engine params. 9880 (extrinsic_state::get_logger): New accessor. 9881 (extrinsic_state::get_engine): New accessor. 9882 (extrinsic_state::get_model_manager): New accessor. 9883 (extrinsic_state::m_logger): New field. 9884 (extrinsic_state::m_engine): New field. 9885 (struct default_hash_traits<svalue_id>): Delete. 9886 (pod_hash_traits<svalue_id>::hash): Delete. 9887 (pod_hash_traits<svalue_id>::equal): Delete. 9888 (pod_hash_traits<svalue_id>::mark_deleted): Delete. 9889 (pod_hash_traits<svalue_id>::mark_empty): Delete. 9890 (pod_hash_traits<svalue_id>::is_deleted): Delete. 9891 (pod_hash_traits<svalue_id>::is_empty): Delete. 9892 (sm_state_map::entry_t::entry_t): Port from svalue_id to 9893 const svalue *. 9894 (sm_state_map::entry_t::m_origin): Likewise. 9895 (sm_state_map::map_t): Likewise. 9896 (sm_state_map::sm_state_map): Add state_machine and index params. 9897 (sm_state_map::clone_with_remapping): Delete. 9898 (sm_state_map::print): Drop sm param; add simple and multiline 9899 params. 9900 (sm_state_map::dump): Drop sm param; add simple param. 9901 (sm_state_map::get_state): Port from svalue_id to const svalue *. 9902 Add ext_state param. 9903 (sm_state_map::get_origin): Likewise. 9904 (sm_state_map::set_state): Likewise. 9905 (sm_state_map::impl_set_state): Likewise. 9906 (sm_state_map::purge_for_unknown_fncall): Delete. 9907 (sm_state_map::remap_svalue_ids): Delete. 9908 (sm_state_map::on_svalue_purge): Delete. 9909 (sm_state_map::on_svalue_leak): New. 9910 (sm_state_map::on_liveness_change): New. 9911 (sm_state_map::on_inherited_svalue): Delete. 9912 (sm_state_map::on_cast): Delete. 9913 (sm_state_map::validate): Delete. 9914 (sm_state_map::on_unknown_change): Port from svalue_id to 9915 const svalue *. Add is_mutable and ext_state params. 9916 (sm_state_map::canonicalize_svalue): New. 9917 (sm_state_map::m_sm): New field. 9918 (sm_state_map::m_sm_idx): New field. 9919 (program_state::operator=): Delete. 9920 (program_state::dump_to_pp): Drop "summarize" param, adding 9921 "simple" and "multiline". 9922 (program_state::dump_to_file): Likewise. 9923 (program_state::dump): Rename "summarize" to "simple". 9924 (program_state::push_frame): New. 9925 (program_state::get_current_function): New. 9926 (program_state::on_edge): Drop "change" param. 9927 (program_state::prune_for_point): Likewise. Add enode_for_diag 9928 param. 9929 (program_state::remap_svalue_ids): Delete. 9930 (program_state::get_representative_tree): Port from svalue_id to 9931 const svalue *. 9932 (program_state::can_purge_p): Likewise. Pass ext_state to get_state. 9933 (program_state::can_merge_with_p): Add point param. 9934 (program_state::detect_leaks): New. 9935 (state_change_visitor::on_state_change): Port from tree and 9936 svalue_id to a pair of const svalue *. 9937 (class state_change): Delete. 9938 * region.cc: New file. 9939 * region-model-impl-calls.cc: New file. 9940 * region-model-manager.cc: New file. 9941 * region-model-reachability.cc: New file. 9942 * region-model-reachability.h: New file. 9943 * region-model.cc: Include "analyzer/call-string.h", 9944 "analyzer/program-point.h", and "analyzer/store.h" before 9945 "analyzer/region-model.h". Include 9946 "analyzer/region-model-reachability.h". 9947 (dump_tree): Make non-static. 9948 (dump_quoted_tree): Make non-static. 9949 (print_quoted_type): Make non-static. 9950 (path_var::dump): Delete. 9951 (dump_separator): Delete. 9952 (class impl_constraint_manager): Delete. 9953 (svalue_id::print): Delete. 9954 (svalue_id::dump_node_name_to_pp): Delete. 9955 (svalue_id::validate): Delete. 9956 (region_id::print): Delete. 9957 (region_id::dump_node_name_to_pp): Delete. 9958 (region_id::validate): Delete. 9959 (region_id_set::region_id_set): Delete. 9960 (svalue_id_set::svalue_id_set): Delete. 9961 (svalue::operator==): Delete. 9962 (svalue::hash): Delete. 9963 (svalue::print): Delete. 9964 (svalue::dump_dot_to_pp): Delete. 9965 (svalue::remap_region_ids): Delete. 9966 (svalue::walk_for_canonicalization): Delete. 9967 (svalue::get_child_sid): Delete. 9968 (svalue::maybe_get_constant): Delete. 9969 (region_svalue::compare_fields): Delete. 9970 (region_svalue::add_to_hash): Delete. 9971 (region_svalue::print_details): Delete. 9972 (region_svalue::dump_dot_to_pp): Delete. 9973 (region_svalue::remap_region_ids): Delete. 9974 (region_svalue::merge_values): Delete. 9975 (region_svalue::walk_for_canonicalization): Delete. 9976 (region_svalue::eval_condition): Delete. 9977 (constant_svalue::compare_fields): Delete. 9978 (constant_svalue::add_to_hash): Delete. 9979 (constant_svalue::merge_values): Delete. 9980 (constant_svalue::eval_condition): Move to svalue.cc. 9981 (constant_svalue::print_details): Delete. 9982 (constant_svalue::get_child_sid): Delete. 9983 (unknown_svalue::compare_fields): Delete. 9984 (unknown_svalue::add_to_hash): Delete. 9985 (unknown_svalue::print_details): Delete. 9986 (poison_kind_to_str): Move to svalue.cc. 9987 (poisoned_svalue::compare_fields): Delete. 9988 (poisoned_svalue::add_to_hash): Delete. 9989 (poisoned_svalue::print_details): Delete. 9990 (region_kind_to_str): Move to region.cc and reimplement. 9991 (region::operator==): Delete. 9992 (region::get_parent_region): Delete. 9993 (region::set_value): Delete. 9994 (region::become_active_view): Delete. 9995 (region::deactivate_any_active_view): Delete. 9996 (region::deactivate_view): Delete. 9997 (region::get_value): Delete. 9998 (region::get_inherited_child_sid): Delete. 9999 (region_model::copy_region): Delete. 10000 (region_model::copy_struct_region): Delete. 10001 (region_model::copy_union_region): Delete. 10002 (region_model::copy_array_region): Delete. 10003 (region::hash): Delete. 10004 (region::print): Delete. 10005 (region::dump_dot_to_pp): Delete. 10006 (region::dump_to_pp): Delete. 10007 (region::dump_child_label): Delete. 10008 (region::validate): Delete. 10009 (region::remap_svalue_ids): Delete. 10010 (region::remap_region_ids): Delete. 10011 (region::add_view): Delete. 10012 (region::get_view): Delete. 10013 (region::region): Move to region.cc. 10014 (region::add_to_hash): Delete. 10015 (region::print_fields): Delete. 10016 (region::non_null_p): Delete. 10017 (primitive_region::clone): Delete. 10018 (primitive_region::walk_for_canonicalization): Delete. 10019 (map_region::map_region): Delete. 10020 (map_region::compare_fields): Delete. 10021 (map_region::print_fields): Delete. 10022 (map_region::validate): Delete. 10023 (map_region::dump_dot_to_pp): Delete. 10024 (map_region::dump_child_label): Delete. 10025 (map_region::get_or_create): Delete. 10026 (map_region::get): Delete. 10027 (map_region::add_to_hash): Delete. 10028 (map_region::remap_region_ids): Delete. 10029 (map_region::unbind): Delete. 10030 (map_region::get_tree_for_child_region): Delete. 10031 (map_region::get_tree_for_child_region): Delete. 10032 (tree_cmp): Move to region.cc. 10033 (map_region::can_merge_p): Delete. 10034 (map_region::walk_for_canonicalization): Delete. 10035 (map_region::get_value_by_name): Delete. 10036 (struct_or_union_region::valid_key_p): Delete. 10037 (struct_or_union_region::compare_fields): Delete. 10038 (struct_region::clone): Delete. 10039 (struct_region::compare_fields): Delete. 10040 (union_region::clone): Delete. 10041 (union_region::compare_fields): Delete. 10042 (frame_region::compare_fields): Delete. 10043 (frame_region::clone): Delete. 10044 (frame_region::valid_key_p): Delete. 10045 (frame_region::print_fields): Delete. 10046 (frame_region::add_to_hash): Delete. 10047 (globals_region::compare_fields): Delete. 10048 (globals_region::clone): Delete. 10049 (globals_region::valid_key_p): Delete. 10050 (code_region::compare_fields): Delete. 10051 (code_region::clone): Delete. 10052 (code_region::valid_key_p): Delete. 10053 (array_region::array_region): Delete. 10054 (array_region::get_element): Delete. 10055 (array_region::clone): Delete. 10056 (array_region::compare_fields): Delete. 10057 (array_region::print_fields): Delete. 10058 (array_region::validate): Delete. 10059 (array_region::dump_dot_to_pp): Delete. 10060 (array_region::dump_child_label): Delete. 10061 (array_region::get_or_create): Delete. 10062 (array_region::get): Delete. 10063 (array_region::add_to_hash): Delete. 10064 (array_region::remap_region_ids): Delete. 10065 (array_region::get_key_for_child_region): Delete. 10066 (array_region::key_cmp): Delete. 10067 (array_region::walk_for_canonicalization): Delete. 10068 (array_region::key_from_constant): Delete. 10069 (array_region::constant_from_key): Delete. 10070 (function_region::compare_fields): Delete. 10071 (function_region::clone): Delete. 10072 (function_region::valid_key_p): Delete. 10073 (stack_region::stack_region): Delete. 10074 (stack_region::compare_fields): Delete. 10075 (stack_region::clone): Delete. 10076 (stack_region::print_fields): Delete. 10077 (stack_region::dump_child_label): Delete. 10078 (stack_region::validate): Delete. 10079 (stack_region::push_frame): Delete. 10080 (stack_region::get_current_frame_id): Delete. 10081 (stack_region::pop_frame): Delete. 10082 (stack_region::add_to_hash): Delete. 10083 (stack_region::remap_region_ids): Delete. 10084 (stack_region::can_merge_p): Delete. 10085 (stack_region::walk_for_canonicalization): Delete. 10086 (stack_region::get_value_by_name): Delete. 10087 (heap_region::heap_region): Delete. 10088 (heap_region::compare_fields): Delete. 10089 (heap_region::clone): Delete. 10090 (heap_region::walk_for_canonicalization): Delete. 10091 (root_region::root_region): Delete. 10092 (root_region::compare_fields): Delete. 10093 (root_region::clone): Delete. 10094 (root_region::print_fields): Delete. 10095 (root_region::validate): Delete. 10096 (root_region::dump_child_label): Delete. 10097 (root_region::push_frame): Delete. 10098 (root_region::get_current_frame_id): Delete. 10099 (root_region::pop_frame): Delete. 10100 (root_region::ensure_stack_region): Delete. 10101 (root_region::get_stack_region): Delete. 10102 (root_region::ensure_globals_region): Delete. 10103 (root_region::get_code_region): Delete. 10104 (root_region::ensure_code_region): Delete. 10105 (root_region::get_globals_region): Delete. 10106 (root_region::ensure_heap_region): Delete. 10107 (root_region::get_heap_region): Delete. 10108 (root_region::remap_region_ids): Delete. 10109 (root_region::can_merge_p): Delete. 10110 (root_region::add_to_hash): Delete. 10111 (root_region::walk_for_canonicalization): Delete. 10112 (root_region::get_value_by_name): Delete. 10113 (symbolic_region::symbolic_region): Delete. 10114 (symbolic_region::compare_fields): Delete. 10115 (symbolic_region::clone): Delete. 10116 (symbolic_region::walk_for_canonicalization): Delete. 10117 (symbolic_region::print_fields): Delete. 10118 (region_model::region_model): Add region_model_manager * param. 10119 Reimplement in terms of store, dropping impl_constraint_manager 10120 subclass. 10121 (region_model::operator=): Reimplement in terms of store 10122 (region_model::operator==): Likewise. 10123 (region_model::hash): Likewise. 10124 (region_model::print): Delete. 10125 (region_model::print_svalue): Delete. 10126 (region_model::dump_dot_to_pp): Delete. 10127 (region_model::dump_dot_to_file): Delete. 10128 (region_model::dump_dot): Delete. 10129 (region_model::dump_to_pp): Replace "summarize" param with 10130 "simple" and "multiline". Port to store-based implementation. 10131 (region_model::dump): Replace "summarize" param with "simple" and 10132 "multiline". 10133 (dump_vec_of_tree): Delete. 10134 (region_model::dump_summary_of_rep_path_vars): Delete. 10135 (region_model::validate): Delete. 10136 (svalue_id_cmp_by_constant_svalue_model): Delete. 10137 (svalue_id_cmp_by_constant_svalue): Delete. 10138 (region_model::canonicalize): Drop "ctxt" param. Reimplement in 10139 terms of store and constraints. 10140 (region_model::canonicalized_p): Remove NULL arg to canonicalize. 10141 (region_model::loop_replay_fixup): New. 10142 (poisoned_value_diagnostic::emit): Tweak wording of warnings. 10143 (region_model::check_for_poison): Delete. 10144 (region_model::get_gassign_result): New. 10145 (region_model::on_assignment): Port to store-based implementation. 10146 (region_model::on_call_pre): Delete calls to check_for_poison. 10147 Move implementations to region-model-impl-calls.c and port to 10148 store-based implementation. 10149 (region_model::on_call_post): Likewise. 10150 (class reachable_regions): Move to region-model-reachability.h/cc 10151 and port to store-based implementation. 10152 (region_model::handle_unrecognized_call): Port to store-based 10153 implementation. 10154 (region_model::get_reachable_svalues): New. 10155 (region_model::on_setjmp): Port to store-based implementation. 10156 (region_model::on_longjmp): Likewise. 10157 (region_model::handle_phi): Drop is_back_edge param and the logic 10158 using it. 10159 (region_model::get_lvalue_1): Port from region_id to const region *. 10160 (region_model::make_region_for_unexpected_tree_code): Delete. 10161 (assert_compat_types): If the check fails, use internal_error to 10162 show the types. 10163 (region_model::get_lvalue): Port from region_id to const region *. 10164 (region_model::get_rvalue_1): Port from svalue_id to const svalue *. 10165 (region_model::get_rvalue): Likewise. 10166 (region_model::get_or_create_ptr_svalue): Delete. 10167 (region_model::get_or_create_constant_svalue): Delete. 10168 (region_model::get_svalue_for_fndecl): Delete. 10169 (region_model::get_region_for_fndecl): Delete. 10170 (region_model::get_svalue_for_label): Delete. 10171 (region_model::get_region_for_label): Delete. 10172 (build_cast): Delete. 10173 (region_model::maybe_cast_1): Delete. 10174 (region_model::maybe_cast): Delete. 10175 (region_model::get_field_region): Delete. 10176 (region_model::get_store_value): New. 10177 (region_model::region_exists_p): New. 10178 (region_model::deref_rvalue): Port from svalue_id to const svalue *. 10179 (region_model::set_value): Likewise. 10180 (region_model::clobber_region): New. 10181 (region_model::purge_region): New. 10182 (region_model::zero_fill_region): New. 10183 (region_model::mark_region_as_unknown): New. 10184 (region_model::eval_condition): Port from svalue_id to 10185 const svalue *. 10186 (region_model::eval_condition_without_cm): Likewise. 10187 (region_model::compare_initial_and_pointer): New. 10188 (region_model::add_constraint): Port from svalue_id to 10189 const svalue *. 10190 (region_model::maybe_get_constant): Delete. 10191 (region_model::get_representative_path_var): New. 10192 (region_model::add_new_malloc_region): Delete. 10193 (region_model::get_representative_tree): Port to const svalue *. 10194 (region_model::get_representative_path_var): Port to 10195 const region *. 10196 (region_model::get_path_vars_for_svalue): Delete. 10197 (region_model::set_to_new_unknown_value): Delete. 10198 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi. 10199 (region_model::update_for_call_superedge): Port from svalue_id to 10200 const svalue *. 10201 (region_model::update_for_return_superedge): Port to store-based 10202 implementation. 10203 (region_model::update_for_call_summary): Replace 10204 set_to_new_unknown_value with mark_region_as_unknown. 10205 (region_model::get_root_region): Delete. 10206 (region_model::get_stack_region_id): Delete. 10207 (region_model::push_frame): Delete. 10208 (region_model::get_current_frame_id): Delete. 10209 (region_model::get_current_function): Delete. 10210 (region_model::pop_frame): Delete. 10211 (region_model::on_top_level_param): New. 10212 (region_model::get_stack_depth): Delete. 10213 (region_model::get_function_at_depth): Delete. 10214 (region_model::get_globals_region_id): Delete. 10215 (region_model::add_svalue): Delete. 10216 (region_model::replace_svalue): Delete. 10217 (region_model::add_region): Delete. 10218 (region_model::get_svalue): Delete. 10219 (region_model::get_region): Delete. 10220 (make_region_for_type): Delete. 10221 (region_model::add_region_for_type): Delete. 10222 (region_model::on_top_level_param): New. 10223 (class restrict_to_used_svalues): Delete. 10224 (region_model::purge_unused_svalues): Delete. 10225 (region_model::push_frame): New. 10226 (region_model::remap_svalue_ids): Delete. 10227 (region_model::remap_region_ids): Delete. 10228 (region_model::purge_regions): Delete. 10229 (region_model::get_descendents): Delete. 10230 (region_model::delete_region_and_descendents): Delete. 10231 (region_model::poison_any_pointers_to_bad_regions): Delete. 10232 (region_model::can_merge_with_p): Delete. 10233 (region_model::get_current_function): New. 10234 (region_model::get_value_by_name): Delete. 10235 (region_model::convert_byte_offset_to_array_index): Delete. 10236 (region_model::pop_frame): New. 10237 (region_model::get_or_create_mem_ref): Delete. 10238 (region_model::get_stack_depth): New. 10239 (region_model::get_frame_at_index): New. 10240 (region_model::unbind_region_and_descendents): New. 10241 (struct bad_pointer_finder): New. 10242 (region_model::get_or_create_pointer_plus_expr): Delete. 10243 (region_model::poison_any_pointers_to_descendents): New. 10244 (region_model::get_or_create_view): Delete. 10245 (region_model::can_merge_with_p): New. 10246 (region_model::get_fndecl_for_call): Port from svalue_id to 10247 const svalue *. 10248 (struct append_ssa_names_cb_data): New. 10249 (get_ssa_name_regions_for_current_frame): New. 10250 (region_model::append_ssa_names_cb): New. 10251 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of 10252 remappings. 10253 (model_merger::dump): Add "simple" param to both overloads. 10254 (model_merger::can_merge_values_p): Delete. 10255 (model_merger::record_regions): Delete. 10256 (model_merger::record_svalues): Delete. 10257 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete. 10258 (svalue_id_merger_mapping::dump_to_pp): Delete. 10259 (svalue_id_merger_mapping::dump): Delete. 10260 (region_model::create_region_for_heap_alloc): New. 10261 (region_model::create_region_for_alloca): New. 10262 (region_model::record_dynamic_extents): New. 10263 (canonicalization::canonicalization): Delete. 10264 (canonicalization::walk_rid): Delete. 10265 (canonicalization::walk_sid): Delete. 10266 (canonicalization::dump_to_pp): Delete. 10267 (canonicalization::dump): Delete. 10268 (inchash::add): Delete overloads for svalue_id and region_id. 10269 (engine::log_stats): New. 10270 (assert_condition): Add overload comparing svalues. 10271 (assert_dump_eq): Pass "true" for multiline. 10272 (selftest::test_dump): Update for rewrite of region_model. 10273 (selftest::test_dump_2): Rename to... 10274 (selftest::test_struct): ...this. Provide a region_model_manager 10275 when creating region_model instance. Remove dump test. Add 10276 checks for get_offset. 10277 (selftest::test_dump_3): Rename to... 10278 (selftest::test_array_1): ...this. Provide a region_model_manager 10279 when creating region_model instance. Remove dump test. 10280 (selftest::test_get_representative_tree): Port from svalue_id to 10281 new API. Add test coverage for various expressions. 10282 (selftest::test_unique_constants): Provide a region_model_manager 10283 for the region_model. Add test coverage for comparing const vs 10284 non-const. 10285 (selftest::test_svalue_equality): Delete. 10286 (selftest::test_region_equality): Delete. 10287 (selftest::test_unique_unknowns): New. 10288 (class purge_all_svalue_ids): Delete. 10289 (class purge_one_svalue_id): Delete. 10290 (selftest::test_purging_by_criteria): Delete. 10291 (selftest::test_initial_svalue_folding): New. 10292 (selftest::test_unaryop_svalue_folding): New. 10293 (selftest::test_binop_svalue_folding): New. 10294 (selftest::test_sub_svalue_folding): New. 10295 (selftest::test_purge_unused_svalues): Delete. 10296 (selftest::test_descendent_of_p): New. 10297 (selftest::test_assignment): Provide a region_model_manager for 10298 the region_model. Drop the dump test. 10299 (selftest::test_compound_assignment): Likewise. 10300 (selftest::test_stack_frames): Port to new implementation. 10301 (selftest::test_get_representative_path_var): Likewise. 10302 (selftest::test_canonicalization_1): Rename to... 10303 (selftest::test_equality_1): ...this. Port to new API, and add 10304 (selftest::test_canonicalization_2): Provide a 10305 region_model_manager when creating region_model instances. 10306 Remove redundant canicalization. 10307 (selftest::test_canonicalization_3): Provide a 10308 region_model_manager when creating region_model instances. 10309 Remove param from calls to region_model::canonicalize. 10310 (selftest::test_canonicalization_4): Likewise. 10311 (selftest::assert_region_models_merge): Constify 10312 out_merged_svalue. Port to new API. 10313 (selftest::test_state_merging): Provide a 10314 region_model_manager when creating region_model instances. 10315 Provide a program_point point when merging them. Replace 10316 set_to_new_unknown_value with usage of placeholder_svalues. 10317 Drop get_value_by_name. Port from svalue_id to const svalue *. 10318 Add test of heap allocation. 10319 (selftest::test_constraint_merging): Provide a 10320 region_model_manager when creating region_model instances. 10321 Provide a program_point point when merging them. Eliminate use 10322 of set_to_new_unknown_value. 10323 (selftest::test_widening_constraints): New. 10324 (selftest::test_iteration_1): New. 10325 (selftest::test_malloc_constraints): Port to store-based 10326 implementation. 10327 (selftest::test_var): New test. 10328 (selftest::test_array_2): New test. 10329 (selftest::test_mem_ref): New test. 10330 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New. 10331 (selftest::test_malloc): New. 10332 (selftest::test_alloca): New. 10333 (selftest::analyzer_region_model_cc_tests): Update for renamings. 10334 Call new functions. 10335 * region-model.h (class path_var): Move to analyzer.h. 10336 (class svalue_id): Delete. 10337 (class region_id): Delete. 10338 (class id_map): Delete. 10339 (svalue_id_map): Delete. 10340 (region_id_map): Delete. 10341 (id_map<T>::id_map): Delete. 10342 (id_map<T>::put): Delete. 10343 (id_map<T>::get_dst_for_src): Delete. 10344 (id_map<T>::get_src_for_dst): Delete. 10345 (id_map<T>::dump_to_pp): Delete. 10346 (id_map<T>::dump): Delete. 10347 (id_map<T>::update): Delete. 10348 (one_way_svalue_id_map): Delete. 10349 (one_way_region_id_map): Delete. 10350 (class region_id_set): Delete. 10351 (class svalue_id_set): Delete. 10352 (struct complexity): New. 10353 (class visitor): New. 10354 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP, 10355 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING, 10356 SK_COMPOUND, and SK_CONJURED. 10357 (svalue::operator==): Delete. 10358 (svalue::operator!=): Delete. 10359 (svalue::clone): Delete. 10360 (svalue::hash): Delete. 10361 (svalue::dump_dot_to_pp): Delete. 10362 (svalue::dump_to_pp): New. 10363 (svalue::dump): New. 10364 (svalue::get_desc): New. 10365 (svalue::dyn_cast_initial_svalue): New. 10366 (svalue::dyn_cast_unaryop_svalue): New. 10367 (svalue::dyn_cast_binop_svalue): New. 10368 (svalue::dyn_cast_sub_svalue): New. 10369 (svalue::dyn_cast_unmergeable_svalue): New. 10370 (svalue::dyn_cast_widening_svalue): New. 10371 (svalue::dyn_cast_compound_svalue): New. 10372 (svalue::dyn_cast_conjured_svalue): New. 10373 (svalue::maybe_undo_cast): New. 10374 (svalue::unwrap_any_unmergeable): New. 10375 (svalue::remap_region_ids): Delete 10376 (svalue::can_merge_p): New. 10377 (svalue::walk_for_canonicalization): Delete 10378 (svalue::get_complexity): New. 10379 (svalue::get_child_sid): Delete 10380 (svalue::accept): New. 10381 (svalue::live_p): New. 10382 (svalue::implicitly_live_p): New. 10383 (svalue::svalue): Add complexity param. 10384 (svalue::add_to_hash): Delete 10385 (svalue::print_details): Delete 10386 (svalue::m_complexity): New field. 10387 (region_svalue::key_t): New struct. 10388 (region_svalue::region_svalue): Port from region_id to 10389 const region_id *. Add complexity. 10390 (region_svalue::compare_fields): Delete. 10391 (region_svalue::clone): Delete. 10392 (region_svalue::dump_dot_to_pp): Delete. 10393 (region_svalue::get_pointee): Port from region_id to 10394 const region_id *. 10395 (region_svalue::remap_region_ids): Delete. 10396 (region_svalue::merge_values): Delete. 10397 (region_svalue::dump_to_pp): New. 10398 (region_svalue::accept): New. 10399 (region_svalue::walk_for_canonicalization): Delete. 10400 (region_svalue::eval_condition): Make params const. 10401 (region_svalue::add_to_hash): Delete. 10402 (region_svalue::print_details): Delete. 10403 (region_svalue::m_rid): Replace with... 10404 (region_svalue::m_reg): ...this. 10405 (is_a_helper <region_svalue *>::test): Convert to... 10406 (is_a_helper <const region_svalue *>::test): ...this. 10407 (template <> struct default_hash_traits<region_svalue::key_t>): 10408 New. 10409 (constant_svalue::constant_svalue): Add complexity. 10410 (constant_svalue::compare_fields): Delete. 10411 (constant_svalue::clone): Delete. 10412 (constant_svalue::add_to_hash): Delete. 10413 (constant_svalue::dump_to_pp): New. 10414 (constant_svalue::accept): New. 10415 (constant_svalue::implicitly_live_p): New. 10416 (constant_svalue::merge_values): Delete. 10417 (constant_svalue::eval_condition): Make params const. 10418 (constant_svalue::get_child_sid): Delete. 10419 (constant_svalue::print_details): Delete. 10420 (is_a_helper <constant_svalue *>::test): Convert to... 10421 (is_a_helper <const constant_svalue *>::test): ...this. 10422 (class unknown_svalue): Update leading comment. 10423 (unknown_svalue::unknown_svalue): Add complexity. 10424 (unknown_svalue::compare_fields): Delete. 10425 (unknown_svalue::add_to_hash): Delete. 10426 (unknown_svalue::dyn_cast_unknown_svalue): Delete. 10427 (unknown_svalue::print_details): Delete. 10428 (unknown_svalue::dump_to_pp): New. 10429 (unknown_svalue::accept): New. 10430 (poisoned_svalue::key_t): New struct. 10431 (poisoned_svalue::poisoned_svalue): Add complexity. 10432 (poisoned_svalue::compare_fields): Delete. 10433 (poisoned_svalue::clone): Delete. 10434 (poisoned_svalue::add_to_hash): Delete. 10435 (poisoned_svalue::dump_to_pp): New. 10436 (poisoned_svalue::accept): New. 10437 (poisoned_svalue::print_details): Delete. 10438 (is_a_helper <poisoned_svalue *>::test): Convert to... 10439 (is_a_helper <const poisoned_svalue *>::test): ...this. 10440 (template <> struct default_hash_traits<poisoned_svalue::key_t>): 10441 New. 10442 (setjmp_record::add_to_hash): New. 10443 (setjmp_svalue::key_t): New struct. 10444 (setjmp_svalue::compare_fields): Delete. 10445 (setjmp_svalue::clone): Delete. 10446 (setjmp_svalue::add_to_hash): Delete. 10447 (setjmp_svalue::setjmp_svalue): Add complexity. 10448 (setjmp_svalue::dump_to_pp): New. 10449 (setjmp_svalue::accept): New. 10450 (setjmp_svalue::void print_details): Delete. 10451 (is_a_helper <const setjmp_svalue *>::test): New. 10452 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New. 10453 (class initial_svalue : public svalue): New. 10454 (is_a_helper <const initial_svalue *>::test): New. 10455 (class unaryop_svalue): New. 10456 (is_a_helper <const unaryop_svalue *>::test): New. 10457 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New. 10458 (class binop_svalue): New. 10459 (is_a_helper <const binop_svalue *>::test): New. 10460 (template <> struct default_hash_traits<binop_svalue::key_t>): New. 10461 (class sub_svalue): New. 10462 (is_a_helper <const sub_svalue *>::test): New. 10463 (template <> struct default_hash_traits<sub_svalue::key_t>): New. 10464 (class unmergeable_svalue): New. 10465 (is_a_helper <const unmergeable_svalue *>::test): New. 10466 (class placeholder_svalue): New. 10467 (is_a_helper <placeholder_svalue *>::test): New. 10468 (class widening_svalue): New. 10469 (is_a_helper <widening_svalue *>::test): New. 10470 (template <> struct default_hash_traits<widening_svalue::key_t>): New. 10471 (class compound_svalue): New. 10472 (is_a_helper <compound_svalue *>::test): New. 10473 (template <> struct default_hash_traits<compound_svalue::key_t>): New. 10474 (class conjured_svalue): New. 10475 (is_a_helper <conjured_svalue *>::test): New. 10476 (template <> struct default_hash_traits<conjured_svalue::key_t>): New. 10477 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and 10478 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET, 10479 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN. 10480 (region_kind_to_str): Delete. 10481 (region::~region): Move implementation to region.cc. 10482 (region::operator==): Delete. 10483 (region::operator!=): Delete. 10484 (region::clone): Delete. 10485 (region::get_id): New. 10486 (region::cmp_ids): New. 10487 (region::dyn_cast_map_region): Delete. 10488 (region::dyn_cast_array_region): Delete. 10489 (region::region_id get_parent): Delete. 10490 (region::get_parent_region): Convert to a simple accessor. 10491 (region::void set_value): Delete. 10492 (region::svalue_id get_value): Delete. 10493 (region::svalue_id get_value_direct): Delete. 10494 (region::svalue_id get_inherited_child_sid): Delete. 10495 (region::dyn_cast_frame_region): New. 10496 (region::dyn_cast_function_region): New. 10497 (region::dyn_cast_decl_region): New. 10498 (region::dyn_cast_field_region): New. 10499 (region::dyn_cast_element_region): New. 10500 (region::dyn_cast_offset_region): New. 10501 (region::dyn_cast_cast_region): New. 10502 (region::dyn_cast_string_region): New. 10503 (region::accept): New. 10504 (region::get_base_region): New. 10505 (region::base_region_p): New. 10506 (region::descendent_of_p): New. 10507 (region::maybe_get_frame_region): New. 10508 (region::maybe_get_decl): New. 10509 (region::hash): Delete. 10510 (region::rint): Delete. 10511 (region::dump_dot_to_pp): Delete. 10512 (region::get_desc): New. 10513 (region::dump_to_pp): Convert to vfunc, changing signature. 10514 (region::dump_child_label): Delete. 10515 (region::remap_svalue_ids): Delete. 10516 (region::remap_region_ids): Delete. 10517 (region::dump): New. 10518 (region::walk_for_canonicalization): Delete. 10519 (region::non_null_p): Drop region_model param. 10520 (region::add_view): Delete. 10521 (region::get_view): Delete. 10522 (region::get_active_view): Delete. 10523 (region::is_view_p): Delete. 10524 (region::cmp_ptrs): New. 10525 (region::validate): Delete. 10526 (region::get_offset): New. 10527 (region::get_byte_size): New. 10528 (region::get_bit_size): New. 10529 (region::get_subregions_for_binding): New. 10530 (region::region): Add complexity param. Convert parent from 10531 region_id to const region *. Drop svalue_id. Drop copy ctor. 10532 (region::symbolic_for_unknown_ptr_p): New. 10533 (region::add_to_hash): Delete. 10534 (region::print_fields): Delete. 10535 (region::get_complexity): New accessor. 10536 (region::become_active_view): Delete. 10537 (region::deactivate_any_active_view): Delete. 10538 (region::deactivate_view): Delete. 10539 (region::calc_offset): New. 10540 (region::m_parent_rid): Delete. 10541 (region::m_sval_id): Delete. 10542 (region::m_complexity): New. 10543 (region::m_id): New. 10544 (region::m_parent): New. 10545 (region::m_view_rids): Delete. 10546 (region::m_is_view): Delete. 10547 (region::m_active_view_rid): Delete. 10548 (region::m_cached_offset): New. 10549 (is_a_helper <region *>::test): Convert to... 10550 (is_a_helper <const region *>::test): ... this. 10551 (class primitive_region): Delete. 10552 (class space_region): New. 10553 (class map_region): Delete. 10554 (is_a_helper <map_region *>::test): Delete. 10555 (class frame_region): Reimplement. 10556 (template <> struct default_hash_traits<frame_region::key_t>): 10557 New. 10558 (class globals_region): Reimplement. 10559 (is_a_helper <globals_region *>::test): Convert to... 10560 (is_a_helper <const globals_region *>::test): ...this. 10561 (class struct_or_union_region): Delete. 10562 (is_a_helper <struct_or_union_region *>::test): Delete. 10563 (class code_region): Reimplement. 10564 (is_a_helper <const code_region *>::test): New. 10565 (class struct_region): Delete. 10566 (is_a_helper <struct_region *>::test): Delete. 10567 (class function_region): Reimplement. 10568 (is_a_helper <function_region *>::test): Convert to... 10569 (is_a_helper <const function_region *>::test): ...this. 10570 (class union_region): Delete. 10571 (is_a_helper <union_region *>::test): Delete. 10572 (class label_region): New. 10573 (is_a_helper <const label_region *>::test): New. 10574 (class scope_region): Delete. 10575 (class stack_region): Reimplement. 10576 (is_a_helper <stack_region *>::test): Convert to... 10577 (is_a_helper <const stack_region *>::test): ...this. 10578 (class heap_region): Reimplement. 10579 (is_a_helper <heap_region *>::test): Convert to... 10580 (is_a_helper <const heap_region *>::test): ...this. 10581 (class root_region): Reimplement. 10582 (is_a_helper <root_region *>::test): Convert to... 10583 (is_a_helper <const root_region *>::test): ...this. 10584 (class symbolic_region): Reimplement. 10585 (is_a_helper <const symbolic_region *>::test): New. 10586 (template <> struct default_hash_traits<symbolic_region::key_t>): 10587 New. 10588 (class decl_region): New. 10589 (is_a_helper <const decl_region *>::test): New. 10590 (class field_region): New. 10591 (template <> struct default_hash_traits<field_region::key_t>): New. 10592 (class array_region): Delete. 10593 (class element_region): New. 10594 (is_a_helper <array_region *>::test): Delete. 10595 (is_a_helper <const element_region *>::test): New. 10596 (template <> struct default_hash_traits<element_region::key_t>): 10597 New. 10598 (class offset_region): New. 10599 (is_a_helper <const offset_region *>::test): New. 10600 (template <> struct default_hash_traits<offset_region::key_t>): 10601 New. 10602 (class cast_region): New. 10603 (is_a_helper <const cast_region *>::test): New. 10604 (template <> struct default_hash_traits<cast_region::key_t>): New. 10605 (class heap_allocated_region): New. 10606 (class alloca_region): New. 10607 (class string_region): New. 10608 (is_a_helper <const string_region *>::test): New. 10609 (class unknown_region): New. 10610 (class region_model_manager): New. 10611 (struct append_ssa_names_cb_data): New. 10612 (class call_details): New. 10613 (region_model::region_model): Add region_model_manager param. 10614 (region_model::print_svalue): Delete. 10615 (region_model::dump_dot_to_pp): Delete. 10616 (region_model::dump_dot_to_file): Delete. 10617 (region_model::dump_dot): Delete. 10618 (region_model::dump_to_pp): Drop summarize param in favor of 10619 simple and multiline. 10620 (region_model::dump): Likewise. 10621 (region_model::summarize_to_pp): Delete. 10622 (region_model::summarize): Delete. 10623 (region_model::void canonicalize): Drop ctxt param. 10624 (region_model::void check_for_poison): Delete. 10625 (region_model::get_gassign_result): New. 10626 (region_model::impl_call_alloca): New. 10627 (region_model::impl_call_analyzer_describe): New. 10628 (region_model::impl_call_analyzer_eval): New. 10629 (region_model::impl_call_builtin_expect): New. 10630 (region_model::impl_call_calloc): New. 10631 (region_model::impl_call_free): New. 10632 (region_model::impl_call_malloc): New. 10633 (region_model::impl_call_memset): New. 10634 (region_model::impl_call_strlen): New. 10635 (region_model::get_reachable_svalues): New. 10636 (region_model::handle_phi): Drop is_back_edge param. 10637 (region_model::region_id get_root_rid): Delete. 10638 (region_model::root_region *get_root_region): Delete. 10639 (region_model::region_id get_stack_region_id): Delete. 10640 (region_model::push_frame): Convert from region_id and svalue_id 10641 to const region * and const svalue *. 10642 (region_model::get_current_frame_id): Replace with... 10643 (region_model::get_current_frame): ...this. 10644 (region_model::pop_frame): Convert from region_id to 10645 const region *. Drop purge and stats param. Add out_result. 10646 (region_model::function *get_function_at_depth): Delete. 10647 (region_model::get_globals_region_id): Delete. 10648 (region_model::add_svalue): Delete. 10649 (region_model::replace_svalue): Delete. 10650 (region_model::add_region): Delete. 10651 (region_model::add_region_for_type): Delete. 10652 (region_model::get_svalue): Delete. 10653 (region_model::get_region): Delete. 10654 (region_model::get_lvalue): Convert from region_id to 10655 const region *. 10656 (region_model::get_rvalue): Convert from svalue_id to 10657 const svalue *. 10658 (region_model::get_or_create_ptr_svalue): Delete. 10659 (region_model::get_or_create_constant_svalue): Delete. 10660 (region_model::get_svalue_for_fndecl): Delete. 10661 (region_model::get_svalue_for_label): Delete. 10662 (region_model::get_region_for_fndecl): Delete. 10663 (region_model::get_region_for_label): Delete. 10664 (region_model::get_frame_at_index (int index) const;): New. 10665 (region_model::maybe_cast): Delete. 10666 (region_model::maybe_cast_1): Delete. 10667 (region_model::get_field_region): Delete. 10668 (region_model::id deref_rvalue): Convert from region_id and 10669 svalue_id to const region * and const svalue *. Drop overload, 10670 passing in both a tree and an svalue. 10671 (region_model::set_value): Convert from region_id and svalue_id to 10672 const region * and const svalue *. 10673 (region_model::set_to_new_unknown_value): Delete. 10674 (region_model::clobber_region (const region *reg);): New. 10675 (region_model::purge_region (const region *reg);): New. 10676 (region_model::zero_fill_region (const region *reg);): New. 10677 (region_model::mark_region_as_unknown (const region *reg);): New. 10678 (region_model::copy_region): Convert from region_id to 10679 const region *. 10680 (region_model::eval_condition): Convert from svalue_id to 10681 const svalue *. 10682 (region_model::eval_condition_without_cm): Likewise. 10683 (region_model::compare_initial_and_pointer): New. 10684 (region_model:maybe_get_constant): Delete. 10685 (region_model::add_new_malloc_region): Delete. 10686 (region_model::get_representative_tree): Convert from svalue_id to 10687 const svalue *. 10688 (region_model::get_representative_path_var): Delete decl taking a 10689 region_id in favor of two decls, for svalue vs region, with an 10690 svalue_set to ensure termination. 10691 (region_model::get_path_vars_for_svalue): Delete. 10692 (region_model::create_region_for_heap_alloc): New. 10693 (region_model::create_region_for_alloca): New. 10694 (region_model::purge_unused_svalues): Delete. 10695 (region_model::remap_svalue_ids): Delete. 10696 (region_model::remap_region_ids): Delete. 10697 (region_model::purge_regions): Delete. 10698 (region_model::get_num_svalues): Delete. 10699 (region_model::get_num_regions): Delete. 10700 (region_model::get_descendents): Delete. 10701 (region_model::get_store): New. 10702 (region_model::delete_region_and_descendents): Delete. 10703 (region_model::get_manager): New. 10704 (region_model::unbind_region_and_descendents): New. 10705 (region_model::can_merge_with_p): Add point param. Drop 10706 svalue_id_merger_mapping. 10707 (region_model::get_value_by_name): Delete. 10708 (region_model::convert_byte_offset_to_array_index): Delete. 10709 (region_model::get_or_create_mem_ref): Delete. 10710 (region_model::get_or_create_pointer_plus_expr): Delete. 10711 (region_model::get_or_create_view): Delete. 10712 (region_model::get_lvalue_1): Convert from region_id to 10713 const region *. 10714 (region_model::get_rvalue_1): Convert from svalue_id to 10715 const svalue *. 10716 (region_model::get_ssa_name_regions_for_current_frame): New. 10717 (region_model::append_ssa_names_cb): New. 10718 (region_model::get_store_value): New. 10719 (region_model::copy_struct_region): Delete. 10720 (region_model::copy_union_region): Delete. 10721 (region_model::copy_array_region): Delete. 10722 (region_model::region_exists_p): New. 10723 (region_model::make_region_for_unexpected_tree_code): Delete. 10724 (region_model::loop_replay_fixup): New. 10725 (region_model::poison_any_pointers_to_bad_regions): Delete. 10726 (region_model::poison_any_pointers_to_descendents): New. 10727 (region_model::dump_summary_of_rep_path_vars): Delete. 10728 (region_model::on_top_level_param): New. 10729 (region_model::record_dynamic_extents): New. 10730 (region_model::m_mgr;): New. 10731 (region_model::m_store;): New. 10732 (region_model::m_svalues;): Delete. 10733 (region_model::m_regions;): Delete. 10734 (region_model::m_root_rid;): Delete. 10735 (region_model::m_current_frame;): New. 10736 (region_model_context::remap_svalue_ids): Delete. 10737 (region_model_context::can_purge_p): Delete. 10738 (region_model_context::on_svalue_leak): New. 10739 (region_model_context::on_svalue_purge): Delete. 10740 (region_model_context::on_liveness_change): New. 10741 (region_model_context::on_inherited_svalue): Delete. 10742 (region_model_context::on_cast): Delete. 10743 (region_model_context::on_unknown_change): Convert from svalue_id to 10744 const svalue * and add is_mutable. 10745 (class noop_region_model_context): Update for region_model_context 10746 changes. 10747 (model_merger::model_merger): Add program_point. Drop 10748 svalue_id_merger_mapping. 10749 (model_merger::dump_to_pp): Add "simple" param. 10750 (model_merger::dump): Likewise. 10751 (model_merger::get_region_a): Delete. 10752 (model_merger::get_region_b): Delete. 10753 (model_merger::can_merge_values_p): Delete. 10754 (model_merger::record_regions): Delete. 10755 (model_merger::record_svalues): Delete. 10756 (model_merger::m_point): New field. 10757 (model_merger::m_map_regions_from_a_to_m): Delete. 10758 (model_merger::m_map_regions_from_b_to_m): Delete. 10759 (model_merger::m_sid_mapping): Delete. 10760 (struct svalue_id_merger_mapping): Delete. 10761 (class engine): New. 10762 (struct canonicalization): Delete. 10763 (inchash::add): Delete decls for hashing svalue_id and region_id. 10764 (test_region_model_context::on_unexpected_tree_code): Require t to 10765 be non-NULL. 10766 (selftest::assert_condition): Add overload comparing a pair of 10767 const svalue *. 10768 * sm-file.cc: Include "tristate.h", "selftest.h", 10769 "analyzer/call-string.h", "analyzer/program-point.h", 10770 "analyzer/store.h", and "analyzer/region-model.h". 10771 (fileptr_state_machine::get_default_state): New. 10772 (fileptr_state_machine::on_stmt): Remove calls to 10773 get_readable_tree in favor of get_diagnostic_tree. 10774 * sm-malloc.cc: Include "tristate.h", "selftest.h", 10775 "analyzer/call-string.h", "analyzer/program-point.h", 10776 "analyzer/store.h", and "analyzer/region-model.h". 10777 (malloc_state_machine::get_default_state): New. 10778 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New. 10779 (malloc_diagnostic::describe_state_change): Handle change.m_expr 10780 being NULL. 10781 (null_arg::emit): Avoid printing "NULL '0'". 10782 (null_arg::describe_final_event): Avoid printing "(0) NULL". 10783 (malloc_leak::emit): Handle m_arg being NULL. 10784 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL. 10785 (malloc_state_machine::on_stmt): Don't call get_readable_tree. 10786 Call get_diagnostic_tree when creating pending diagnostics. 10787 Update for is_zero_assignment becoming a member function of 10788 sm_ctxt. 10789 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()). 10790 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New 10791 vfunc implementation. 10792 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call 10793 get_diagnostic_tree and pass the result to warn_for_state. 10794 * sm-signal.cc: Move includes of "analyzer/call-string.h" and 10795 "analyzer/program-point.h" to before "analyzer/region-model.h", 10796 and also include "analyzer/store.h" before it. 10797 (signal_unsafe_call::describe_state_change): Use 10798 get_dest_function to get handler. 10799 (update_model_for_signal_handler): Pass manager to region_model 10800 ctor. 10801 (register_signal_handler::impl_transition): Update for changes to 10802 get_or_create_node and add_edge. 10803 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to 10804 get_readable_tree, replacing them when calling warn_for_state with 10805 calls to get_diagnostic_tree. 10806 * sm.cc (is_zero_assignment): Delete. 10807 (any_pointer_p): Move to within namespace ana. 10808 * sm.h (is_zero_assignment): Remove decl. 10809 (any_pointer_p): Move decl to within namespace ana. 10810 (state_machine::get_default_state): New vfunc. 10811 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc. 10812 (sm_context::get_readable_tree): Rename to... 10813 (sm_context::get_diagnostic_tree): ...this. 10814 (sm_context::is_zero_assignment): New vfunc. 10815 * store.cc: New file. 10816 * store.h: New file. 10817 * svalue.cc: New file. 10818 10819 2020-05-22 Mark Wielaard <mark (a] klomp.org> 10820 10821 * sm-signal.cc(signal_unsafe_call::emit): Possibly add 10822 gcc_rich_location note for replacement. 10823 (signal_unsafe_call::get_replacement_fn): New private function. 10824 (get_async_signal_unsafe_fns): Add "exit". 10825 10826 2020-04-28 David Malcolm <dmalcolm (a] redhat.com> 10827 10828 PR analyzer/94816 10829 * engine.cc (impl_region_model_context::on_unexpected_tree_code): 10830 Handle NULL tree. 10831 * region-model.cc (region_model::add_region_for_type): Handle 10832 NULL type. 10833 * region-model.h 10834 (test_region_model_context::on_unexpected_tree_code): Handle NULL 10835 tree. 10836 10837 2020-04-28 David Malcolm <dmalcolm (a] redhat.com> 10838 10839 PR analyzer/94447 10840 PR analyzer/94639 10841 PR analyzer/94732 10842 PR analyzer/94754 10843 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete. 10844 * program-state.cc (selftest::test_program_state_dumping): Update 10845 expected dump result for removal of "uninit". 10846 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT 10847 case. 10848 (root_region::ensure_stack_region): Initialize stack with null 10849 svalue_id rather than with a typeless POISON_KIND_UNINIT value. 10850 (root_region::ensure_heap_region): Likewise for the heap. 10851 (region_model::dump_summary_of_rep_path_vars): Remove 10852 summarization of uninit values. 10853 (region_model::validate): Remove check that the stack has a 10854 POISON_KIND_UNINIT value. 10855 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT 10856 case. 10857 (poisoned_value_diagnostic::describe_final_event): Likewise. 10858 (selftest::test_dump): Update expected dump result for removal of 10859 "uninit". 10860 (selftest::test_svalue_equality): Remove "uninit" and "freed". 10861 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT. 10862 10863 2020-04-01 David Malcolm <dmalcolm (a] redhat.com> 10864 10865 PR analyzer/94378 10866 * checker-path.cc: Include "bitmap.h". 10867 * constraint-manager.cc: Likewise. 10868 * diagnostic-manager.cc: Likewise. 10869 * engine.cc: Likewise. 10870 (exploded_node::detect_leaks): Pass null region_id to pop_frame. 10871 * program-point.cc: Include "bitmap.h". 10872 * program-state.cc: Likewise. 10873 * region-model.cc (id_set<region_id>::id_set): Convert to... 10874 (region_id_set::region_id_set): ...this. 10875 (svalue_id_set::svalue_id_set): New ctor. 10876 (region_model::copy_region): New function. 10877 (region_model::copy_struct_region): New function. 10878 (region_model::copy_union_region): New function. 10879 (region_model::copy_array_region): New function. 10880 (stack_region::pop_frame): Drop return value. Add 10881 "result_dst_rid" param; if it is non-null, use copy_region to copy 10882 the result to it. Rather than capture and pass a single "known 10883 used" return value to be used by purge_unused_values, instead 10884 gather and pass a set of known used return values. 10885 (root_region::pop_frame): Drop return value. Add "result_dst_rid" 10886 param. 10887 (region_model::on_assignment): Use copy_region. 10888 (region_model::on_return): Likewise for the result. 10889 (region_model::on_longjmp): Pass null for pop_frame's 10890 result_dst_rid. 10891 (region_model::update_for_return_superedge): Pass the region for the 10892 return value of the call, if any, to pop_frame, rather than setting 10893 the lvalue for the lhs of the result. 10894 (region_model::pop_frame): Drop return value. Add 10895 "result_dst_rid" param. 10896 (region_model::purge_unused_svalues): Convert third param from an 10897 svalue_id * to an svalue_id_set *, updating the initial populating 10898 of the "used" bitmap accordingly. Don't remap it when done. 10899 (struct selftest::coord_test): New selftest fixture, extracted from... 10900 (selftest::test_dump_2): ...here. 10901 (selftest::test_compound_assignment): New selftest. 10902 (selftest::test_stack_frames): Pass null to new param of pop_frame. 10903 (selftest::analyzer_region_model_cc_tests): Call the new selftest. 10904 * region-model.h (class id_set): Delete template. 10905 (class region_id_set): Reimplement, using old id_set implementation. 10906 (class svalue_id_set): Likewise. Convert from auto_sbitmap to 10907 auto_bitmap. 10908 (region::get_active_view): New accessor. 10909 (stack_region::pop_frame): Drop return value. Add 10910 "result_dst_rid" param. 10911 (root_region::pop_frame): Likewise. 10912 (region_model::pop_frame): Likewise. 10913 (region_model::copy_region): New decl. 10914 (region_model::purge_unused_svalues): Convert third param from an 10915 svalue_id * to an svalue_id_set *. 10916 (region_model::copy_struct_region): New decl. 10917 (region_model::copy_union_region): New decl. 10918 (region_model::copy_array_region): New decl. 10919 10920 2020-03-27 David Malcolm <dmalcolm (a] redhat.com> 10921 10922 * program-state.cc (selftest::test_program_state_dumping): Update 10923 expected dump to include symbolic_region's possibly_null field. 10924 * region-model.cc (symbolic_region::print_fields): New vfunc 10925 implementation. 10926 (region_model::add_constraint): Clear m_possibly_null from 10927 symbolic_regions now known to be non-NULL. 10928 (selftest::test_malloc_constraints): New selftest. 10929 (selftest::analyzer_region_model_cc_tests): Call it. 10930 * region-model.h (region::dyn_cast_symbolic_region): Add non-const 10931 overload. 10932 (symbolic_region::dyn_cast_symbolic_region): Implement it. 10933 (symbolic_region::print_fields): New vfunc override decl. 10934 10935 2020-03-27 David Malcolm <dmalcolm (a] redhat.com> 10936 10937 * analyzer.h (class feasibility_problem): New forward decl. 10938 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): 10939 Initialize new fields m_status, m_epath_length, and m_problem. 10940 (saved_diagnostic::~saved_diagnostic): Delete m_problem. 10941 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a 10942 const ref to a mutable ptr. 10943 (dedupe_winners::add): Convert "sd" param from a const ref to a 10944 mutable ptr. Record the length of the exploded_path. Record the 10945 feasibility/infeasibility of sd into sd, capturing a 10946 feasibility_problem when feasible_p fails, and storing it in sd. 10947 (diagnostic_manager::emit_saved_diagnostics): Update for pass by 10948 ptr rather than by const ref. 10949 * diagnostic-manager.h (class saved_diagnostic): Add new enum 10950 status. Add fields m_status, m_epath_length and m_problem. 10951 (saved_diagnostic::set_feasible): New member function. 10952 (saved_diagnostic::set_infeasible): New member function. 10953 (saved_diagnostic::get_feasibility_problem): New accessor. 10954 (saved_diagnostic::get_status): New accessor. 10955 (saved_diagnostic::set_epath_length): New member function. 10956 (saved_diagnostic::get_epath_length): New accessor. 10957 * engine.cc: Include "gimple-pretty-print.h". 10958 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write 10959 a new feasibility_problem to it on failure. 10960 (viz_callgraph_node::dump_dot): Convert begin_tr calls to 10961 begin_trtd. Convert end_tr calls to end_tdtr. 10962 (class exploded_graph_annotator): New subclass of dot_annotator. 10963 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump 10964 after the analysis runs, using exploded_graph_annotator. dumping 10965 to DUMP_BASE_NAME.supergraph-eg.dot. 10966 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make 10967 public. 10968 (exploded_path::feasible_p): Add OUT param. 10969 (class feasibility_problem): New class. 10970 * state-purge.cc (state_purge_annotator::add_node_annotations): 10971 Return a bool, add a "within_table" param. 10972 (print_vec_of_names): Convert begin_tr calls to begin_trtd. 10973 Convert end_tr calls to end_tdtr. 10974 (state_purge_annotator::add_stmt_annotations): Add "within_row" 10975 param. 10976 * state-purge.h ((state_purge_annotator::add_node_annotations): 10977 Return a bool, add a "within_table" param. 10978 (state_purge_annotator::add_stmt_annotations): Add "within_row" 10979 param. 10980 * supergraph.cc (supernode::dump_dot): Call add_node_annotations 10981 twice: as before, passing false for "within_table", then again 10982 with true when within the TABLE element. Convert some begin_tr 10983 calls to begin_trtd, and some end_tr calls to end_tdtr. 10984 Repeat each add_stmt_annotations call, distinguishing between 10985 calls that add TRs and those that add TDs to an existing TR. 10986 Add a call to add_after_node_annotations. 10987 * supergraph.h (dot_annotator::add_node_annotations): Add a 10988 "within_table" param. 10989 (dot_annotator::add_stmt_annotations): Add a "within_row" param. 10990 (dot_annotator::add_after_node_annotations): New vfunc. 10991 10992 2020-03-27 David Malcolm <dmalcolm (a] redhat.com> 10993 10994 * diagnostic-manager.cc (dedupe_winners::add): Show the 10995 exploded_node index in the log messages. 10996 (diagnostic_manager::emit_saved_diagnostics): Log a summary of 10997 m_saved_diagnostics at entry. 10998 10999 2020-03-27 David Malcolm <dmalcolm (a] redhat.com> 11000 11001 * supergraph.cc (superedge::dump): Add space before description; 11002 move newline to non-pretty_printer overload. 11003 11004 2020-03-18 David Malcolm <dmalcolm (a] redhat.com> 11005 11006 * region-model.cc: Include "stor-layout.h". 11007 (region_model::dump_to_pp): Rather than calling 11008 dump_summary_of_map on each of the current frame and the globals, 11009 instead get a vec of representative path_vars for all regions, 11010 and then dump a summary of all of them. 11011 (region_model::dump_summary_of_map): Delete, rewriting into... 11012 (region_model::dump_summary_of_rep_path_vars): ...this new 11013 function, working on a vec of path_vars. 11014 (region_model::set_value): New overload. 11015 (region_model::get_representative_path_var): Rename 11016 "parent_region" local to "parent_reg" and consolidate with other 11017 local. Guard test for grandparent being stack on parent_reg being 11018 non-NULL. Move handling for parent being an array_region to 11019 within guard for parent_reg being non-NULL. 11020 (selftest::make_test_compound_type): New function. 11021 (selftest::test_dump_2): New selftest. 11022 (selftest::test_dump_3): New selftest. 11023 (selftest::test_stack_frames): Update expected output from 11024 simplified dump to show "a" and "b" from parent frame and "y" in 11025 child frame. 11026 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and 11027 test_dump_3. 11028 * region-model.h (region_model::set_value): New overload decl. 11029 (region_model::dump_summary_of_map): Delete. 11030 (region_model::dump_summary_of_rep_path_vars): New. 11031 11032 2020-03-18 David Malcolm <dmalcolm (a] redhat.com> 11033 11034 * region-model.h (class noop_region_model_context): New subclass 11035 of region_model_context. 11036 (class tentative_region_model_context): Inherit from 11037 noop_region_model_context rather than from region_model_context; 11038 drop redundant vfunc implementations. 11039 (class test_region_model_context): Likewise. 11040 11041 2020-03-18 David Malcolm <dmalcolm (a] redhat.com> 11042 11043 * engine.cc (exploded_node::exploded_node): Move implementation 11044 here from header; accept point_and_state by const reference rather 11045 than by value. 11046 * exploded-graph.h (exploded_node::exploded_node): Pass 11047 point_and_state by const reference rather than by value. Move 11048 body to engine.cc. 11049 11050 2020-03-18 Jakub Jelinek <jakub (a] redhat.com> 11051 11052 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word 11053 issue in a comment. 11054 * region-model.cc (region_model::make_region_for_unexpected_tree_code, 11055 region_model::delete_region_and_descendents): Likewise. 11056 * engine.cc (class exploded_cluster): Likewise. 11057 * diagnostic-manager.cc (class path_builder): Likewise. 11058 11059 2020-03-13 David Malcolm <dmalcolm (a] redhat.com> 11060 11061 PR analyzer/94099 11062 PR analyzer/94105 11063 * diagnostic-manager.cc (for_each_state_change): Bulletproof 11064 against errors in get_rvalue by passing a 11065 tentative_region_model_context and rejecting if there's an error. 11066 * region-model.cc (region_model::get_lvalue_1): When handling 11067 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR. 11068 11069 2020-03-06 David Malcolm <dmalcolm (a] redhat.com> 11070 11071 * analyzer.h (class array_region): New forward decl. 11072 * program-state.cc (selftest::test_program_state_dumping_2): New. 11073 (selftest::analyzer_program_state_cc_tests): Call it. 11074 * region-model.cc (array_region::constant_from_key): New. 11075 (region_model::get_representative_tree): Handle region_svalue by 11076 generating an ADDR_EXPR. 11077 (region_model::get_representative_path_var): In view handling, 11078 remove erroneous TREE_TYPE when determining the type of the tree. 11079 Handle array regions and STRING_CST. 11080 (selftest::assert_dump_tree_eq): New. 11081 (ASSERT_DUMP_TREE_EQ): New macro. 11082 (selftest::test_get_representative_tree): New selftest. 11083 (selftest::analyzer_region_model_cc_tests): Call it. 11084 * region-model.h (region::dyn_cast_array_region): New vfunc. 11085 (array_region::dyn_cast_array_region): New vfunc implementation. 11086 (array_region::constant_from_key): New decl. 11087 11088 2020-03-06 David Malcolm <dmalcolm (a] redhat.com> 11089 11090 * analyzer.h (dump_quoted_tree): New decl. 11091 * engine.cc (exploded_node::dump_dot): Pass region model to 11092 sm_state_map::print. 11093 * program-state.cc: Include diagnostic-core.h. 11094 (sm_state_map::print): Add "model" param and use it to print 11095 representative trees. Only print origin information if non-null. 11096 (sm_state_map::dump): Pass NULL for model to print call. 11097 (program_state::print): Pass region model to sm_state_map::print. 11098 (program_state::dump_to_pp): Use spaces rather than newlines when 11099 summarizing. Pass region_model to sm_state_map::print. 11100 (ana::selftest::assert_dump_eq): New function. 11101 (ASSERT_DUMP_EQ): New macro. 11102 (ana::selftest::test_program_state_dumping): New function. 11103 (ana::selftest::analyzer_program_state_cc_tests): Call it. 11104 * program-state.h (program_state::print): Add model param. 11105 * region-model.cc (dump_quoted_tree): New function. 11106 (map_region::print_fields): Use dump_quoted_tree rather than 11107 %qE to avoid lang-dependent output. 11108 (map_region::dump_child_label): Likewise. 11109 (region_model::dump_summary_of_map): For SK_REGION, when 11110 get_representative_path_var fails, print the region id rather than 11111 erroneously printing NULL. 11112 * sm.cc (state_machine::get_state_by_name): New function. 11113 * sm.h (state_machine::get_state_by_name): New decl. 11114 11115 2020-03-04 David Malcolm <dmalcolm (a] redhat.com> 11116 11117 * region-model.cc (region::validate): Convert model param from ptr 11118 to reference. Update comment to reflect that it's now a vfunc. 11119 (map_region::validate): New vfunc implementation. 11120 (array_region::validate): New vfunc implementation. 11121 (stack_region::validate): New vfunc implementation. 11122 (root_region::validate): New vfunc implementation. 11123 (region_model::validate): Pass a reference rather than a pointer 11124 to the region::validate vfunc. 11125 * region-model.h (region::validate): Make virtual. Convert model 11126 param from ptr to reference. 11127 (map_region::validate): New vfunc decl. 11128 (array_region::validate): New vfunc decl. 11129 (stack_region::validate): New vfunc decl. 11130 (root_region::validate): New vfunc decl. 11131 11132 2020-03-04 David Malcolm <dmalcolm (a] redhat.com> 11133 11134 PR analyzer/93993 11135 * region-model.cc (region_model::on_call_pre): Handle 11136 BUILT_IN_EXPECT and its variants. 11137 (region_model::add_any_constraints_from_ssa_def_stmt): Split out 11138 gassign handling into add_any_constraints_from_gassign; add gcall 11139 handling. 11140 (region_model::add_any_constraints_from_gassign): New function, 11141 based on the above. Add handling for NOP_EXPR. 11142 (region_model::add_any_constraints_from_gcall): New function. 11143 (region_model::get_representative_path_var): Handle views. 11144 * region-model.h 11145 (region_model::add_any_constraints_from_ssa_def_stmt): New decl. 11146 (region_model::add_any_constraints_from_gassign): New decl. 11147 11148 2020-03-04 David Malcolm <dmalcolm (a] redhat.com> 11149 11150 PR analyzer/93993 11151 * checker-path.h (state_change_event::get_lvalue): Add ctxt param 11152 and pass it to region_model::get_value call. 11153 * diagnostic-manager.cc (get_any_origin): Pass a 11154 tentative_region_model_context to the calls to get_lvalue and reject 11155 the comparison if errors occur. 11156 (can_be_expr_of_interest_p): New function. 11157 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for 11158 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs. 11159 Pass a tentative_region_model_context to the calls to 11160 state_change_event::get_lvalue and reject the comparison if errors 11161 occur. 11162 (diagnostic_manager::update_for_unsuitable_sm_exprs): New. 11163 * diagnostic-manager.h 11164 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl. 11165 * region-model.h (class tentative_region_model_context): New class. 11166 11167 2020-03-04 David Malcolm <dmalcolm (a] redhat.com> 11168 11169 * engine.cc (worklist::worklist): Remove unused field m_eg. 11170 (class viz_callgraph_edge): Remove unused field m_call_sedge. 11171 (class viz_callgraph): Remove unused field m_sg. 11172 * exploded-graph.h (worklist::::m_eg): Remove unused field. 11173 11174 2020-03-02 David Malcolm <dmalcolm (a] redhat.com> 11175 11176 * analyzer.opt (fanalyzer-show-duplicate-count): New option. 11177 * diagnostic-manager.cc 11178 (diagnostic_manager::emit_saved_diagnostic): Use the above to 11179 guard the printing of the duplicate count. 11180 11181 2020-03-02 David Malcolm <dmalcolm (a] redhat.com> 11182 11183 PR analyzer/93959 11184 * analyzer.cc (is_std_function_p): New function. 11185 (is_std_named_call_p): New functions. 11186 * analyzer.h (is_std_named_call_p): New decl. 11187 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::" 11188 variants when checking for malloc, calloc and free. 11189 11190 2020-02-26 David Malcolm <dmalcolm (a] redhat.com> 11191 11192 PR analyzer/93950 11193 * diagnostic-manager.cc 11194 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is 11195 either NULL or not a constant. When updating var, bulletproof 11196 against constant values. 11197 11198 2020-02-26 David Malcolm <dmalcolm (a] redhat.com> 11199 11200 PR analyzer/93947 11201 * region-model.cc (region_model::get_fndecl_for_call): Gracefully 11202 fail for fn_decls that don't have a cgraph_node. 11203 11204 2020-02-26 David Malcolm <dmalcolm (a] redhat.com> 11205 11206 * bar-chart.cc: New file. 11207 * bar-chart.h: New file. 11208 * engine.cc: Include "analyzer/bar-chart.h". 11209 (stats::log): Only log the m_num_nodes kinds that are non-zero. 11210 (stats::dump): Likewise when dumping. 11211 (stats::get_total_enodes): New. 11212 (exploded_graph::get_or_create_node): Increment the per-point-data 11213 m_excess_enodes when hitting the per-program-point limit on 11214 enodes. 11215 (exploded_graph::print_bar_charts): New. 11216 (exploded_graph::log_stats): Log the number of unprocessed enodes 11217 in the worklist. Call print_bar_charts. 11218 (exploded_graph::dump_stats): Print the number of unprocessed 11219 enodes in the worklist. 11220 * exploded-graph.h (stats::get_total_enodes): New decl. 11221 (struct per_program_point_data): Add field m_excess_enodes. 11222 (exploded_graph::print_bar_charts): New decl. 11223 * supergraph.cc (superedge::dump): New. 11224 (superedge::dump): New. 11225 * supergraph.h (supernode::get_function): New. 11226 (superedge::dump): New decl. 11227 (superedge::dump): New decl. 11228 11229 2020-02-24 David Malcolm <dmalcolm (a] redhat.com> 11230 11231 * engine.cc (exploded_graph::get_or_create_node): Dump the 11232 program_state to the pp, rather than to stderr. 11233 11234 2020-02-24 David Malcolm <dmalcolm (a] redhat.com> 11235 11236 PR analyzer/93032 11237 * sm.cc (make_checkers): Require the "taint" checker to be 11238 explicitly enabled. 11239 11240 2020-02-24 David Malcolm <dmalcolm (a] redhat.com> 11241 11242 PR analyzer/93899 11243 * engine.cc 11244 (impl_region_model_context::impl_region_model_context): Add logger 11245 param. 11246 * engine.cc (exploded_graph::add_function_entry): Create an 11247 impl_region_model_context and pass it to the push_frame call. 11248 Bail if the resulting state is invalid. 11249 (exploded_graph::build_initial_worklist): Likewise. 11250 (exploded_graph::build_initial_worklist): Handle the case where 11251 add_function_entry fails. 11252 * exploded-graph.h 11253 (impl_region_model_context::impl_region_model_context): Add logger 11254 param. 11255 * region-model.cc (map_region::get_or_create): Add ctxt param and 11256 pass it to add_region_for_type. 11257 (map_region::can_merge_p): Pass NULL as a ctxt to call to 11258 get_or_create. 11259 (array_region::get_element): Pass ctxt to call to get_or_create. 11260 (array_region::get_or_create): Add ctxt param and pass it to 11261 add_region_for_type. 11262 (root_region::push_frame): Pass ctxt to get_or_create calls. 11263 (region_model::get_lvalue_1): Likewise. 11264 (region_model::make_region_for_unexpected_tree_code): Assert that 11265 ctxt is non-NULL. 11266 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl 11267 and get_svalue_for_label calls. 11268 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it 11269 to get_region_for_fndecl. 11270 (region_model::get_region_for_fndecl): Add ctxt param and pass it 11271 to get_or_create. 11272 (region_model::get_svalue_for_label): Add ctxt param and pass it 11273 to get_region_for_label. 11274 (region_model::get_region_for_label): Add ctxt param and pass it 11275 to get_region_for_fndecl and get_or_create. 11276 (region_model::get_field_region): Add ctxt param and pass it to 11277 get_or_create_view and get_or_create. 11278 (make_region_for_type): Replace gcc_unreachable with return NULL. 11279 (region_model::add_region_for_type): Add ctxt param. Handle a 11280 return of NULL from make_region_for_type by calling 11281 make_region_for_unexpected_tree_code. 11282 (region_model::get_or_create_mem_ref): Pass ctxt to calls to 11283 get_or_create_view. 11284 (region_model::get_or_create_view): Add ctxt param and pass it to 11285 add_region_for_type. 11286 (selftest::test_state_merging): Pass ctxt to get_or_create_view. 11287 * region-model.h (region_model::get_or_create): Add ctxt param. 11288 (region_model::add_region_for_type): Likewise. 11289 (region_model::get_svalue_for_fndecl): Likewise. 11290 (region_model::get_svalue_for_label): Likewise. 11291 (region_model::get_region_for_fndecl): Likewise. 11292 (region_model::get_region_for_label): Likewise. 11293 (region_model::get_field_region): Likewise. 11294 (region_model::get_or_create_view): Likewise. 11295 11296 2020-02-24 David Malcolm <dmalcolm (a] redhat.com> 11297 11298 * checker-path.cc (superedge_event::should_filter_p): Update 11299 filter for empty descriptions to cover verbosity level 3 as well 11300 as 2. 11301 * diagnostic-manager.cc: Include "analyzer/reachability.h". 11302 (class path_builder): New class. 11303 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder 11304 and pass it to build_emission_path, rather passing eg; similarly 11305 for add_events_for_eedge and ext_state. 11306 (diagnostic_manager::build_emission_path): Replace "eg" param 11307 with a path_builder, pass it to add_events_for_eedge. 11308 (diagnostic_manager::add_events_for_eedge): Replace ext_state 11309 param with path_builder; pass it to add_events_for_superedge. 11310 (diagnostic_manager::significant_edge_p): New. 11311 (diagnostic_manager::add_events_for_superedge): Add path_builder 11312 param. Reject insignificant edges at verbosity levels below 3. 11313 (diagnostic_manager::prune_for_sm_diagnostic): Update highest 11314 verbosity level to 4. 11315 * diagnostic-manager.h (class path_builder): New forward decl. 11316 (diagnostic_manager::build_emission_path): Replace "eg" param 11317 with a path_builder. 11318 (diagnostic_manager::add_events_for_eedge): Replace ext_state 11319 param with path_builder. 11320 (diagnostic_manager::significant_edge_p): New. 11321 (diagnostic_manager::add_events_for_superedge): Add path_builder 11322 param. 11323 * reachability.h: New file. 11324 11325 2020-02-18 David Malcolm <dmalcolm (a] redhat.com> 11326 11327 PR analyzer/93692 11328 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description. 11329 11330 2020-02-18 David Malcolm <dmalcolm (a] redhat.com> 11331 11332 PR analyzer/93777 11333 * region-model.cc (region_model::maybe_cast_1): Replace assertion 11334 that build_cast returns non-NULL with a conditional, falling 11335 through to the logic which returns a new unknown value of the 11336 desired type if it fails. 11337 11338 2020-02-18 David Malcolm <dmalcolm (a] redhat.com> 11339 11340 PR analyzer/93778 11341 * engine.cc (impl_region_model_context::on_unknown_tree_code): 11342 Rename to... 11343 (impl_region_model_context::on_unexpected_tree_code): ...this and 11344 convert first argument from path_var to tree. 11345 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall. 11346 * exploded-graph.h (region_model_context::on_unknown_tree_code): 11347 Rename to... 11348 (region_model_context::on_unexpected_tree_code): ...this and 11349 convert first argument from path_var to tree. 11350 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add 11351 ctxt param and pass on to calls to get_rvalue. 11352 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add 11353 ctxt param. 11354 * region-model.cc (region_model::handle_unrecognized_call): Pass 11355 ctxt on to call to get_rvalue. 11356 (region_model::get_lvalue_1): Move body of default case to 11357 region_model::make_region_for_unexpected_tree_code and call it. 11358 Within COMPONENT_REF case, reject attempts to handle types other 11359 than RECORD_TYPE and UNION_TYPE. 11360 (region_model::make_region_for_unexpected_tree_code): New 11361 function, based on default case of region_model::get_lvalue_1. 11362 * region-model.h 11363 (region_model::make_region_for_unexpected_tree_code): New decl. 11364 (region_model::on_unknown_tree_code): Rename to... 11365 (region_model::on_unexpected_tree_code): ...this and convert first 11366 argument from path_var to tree. 11367 (class test_region_model_context): Update vfunc implementation for 11368 above change. 11369 11370 2020-02-18 David Malcolm <dmalcolm (a] redhat.com> 11371 11372 PR analyzer/93774 11373 * region-model.cc 11374 (region_model::convert_byte_offset_to_array_index): Use 11375 int_size_in_bytes before calling size_in_bytes, to gracefully fail 11376 on incomplete types. 11377 11378 2020-02-17 David Malcolm <dmalcolm (a] redhat.com> 11379 11380 PR analyzer/93775 11381 * region-model.cc (region_model::get_fndecl_for_call): Handle the 11382 case where the code_region's get_tree_for_child_region returns 11383 NULL. 11384 11385 2020-02-17 David Malcolm <dmalcolm (a] redhat.com> 11386 11387 PR analyzer/93388 11388 * engine.cc (impl_region_model_context::on_unknown_tree_code): 11389 New. 11390 (exploded_graph::get_or_create_node): Reject invalid states. 11391 * exploded-graph.h 11392 (impl_region_model_context::on_unknown_tree_code): New decl. 11393 (point_and_state::point_and_state): Assert that the state is 11394 valid. 11395 * program-state.cc (program_state::program_state): Initialize 11396 m_valid to true. 11397 (program_state::operator=): Copy m_valid. 11398 (program_state::program_state): Likewise for move constructor. 11399 (program_state::print): Print m_valid. 11400 (program_state::dump_to_pp): Likewise. 11401 * program-state.h (program_state::m_valid): New field. 11402 * region-model.cc (region_model::get_lvalue_1): Implement the 11403 default case by returning a new symbolic region and calling 11404 the context's on_unknown_tree_code, rather than issuing an 11405 internal_error. Implement VIEW_CONVERT_EXPR. 11406 * region-model.h (region_model_context::on_unknown_tree_code): New 11407 vfunc. 11408 (test_region_model_context::on_unknown_tree_code): New. 11409 11410 2020-02-17 David Malcolm <dmalcolm (a] redhat.com> 11411 11412 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For 11413 transition to the "null" state, only say "assuming" when 11414 transitioning from the "unchecked" state. 11415 11416 2020-02-17 David Malcolm <dmalcolm (a] redhat.com> 11417 11418 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic): 11419 Add const overload. 11420 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics. 11421 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add 11422 const overload. 11423 11424 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11425 11426 PR analyzer/93288 11427 * analysis-plan.cc (analysis_plan::use_summary_p): Look through 11428 the ultimate_alias_target when getting the called function. 11429 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to 11430 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than 11431 gimple_call_fndecl. 11432 * region-model.cc (region_model::get_fndecl_for_call): Use 11433 ultimate_alias_target on fndecl. 11434 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New 11435 function. 11436 (supergraph_call_edge): Use it when rejecting edges without 11437 functions. 11438 (supergraph::supergraph): Use it to get the function for the 11439 cgraph_edge when building interprocedural superedges. 11440 (callgraph_superedge::get_callee_function): Use it. 11441 * supergraph.h (supergraph::get_num_snodes): Make param const. 11442 (supergraph::function_to_num_snodes_t): Make first type param 11443 const. 11444 11445 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11446 11447 PR analyzer/93374 11448 * engine.cc (exploded_edge::exploded_edge): Add ext_state param 11449 and pass it to change.validate. 11450 (exploded_graph::get_or_create_node): Move purging of change 11451 svalues to also cover the case of reusing an existing enode. 11452 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's 11453 ctor. 11454 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state 11455 param. 11456 * program-state.cc (state_change::sm_change::validate): Likewise. 11457 Assert that m_sm_idx is sane. Use ext_state to validate 11458 m_old_state and m_new_state. 11459 (state_change::validate): Add ext_state param and pass it to 11460 the sm_change validate calls. 11461 * program-state.h (state_change::sm_change::validate): Add 11462 ext_state param. 11463 (state_change::validate): Likewise. 11464 11465 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11466 11467 PR analyzer/93669 11468 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing 11469 case of STATUS_WORKLIST in implementation of 11470 "__analyzer_dump_exploded_nodes". 11471 11472 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11473 11474 PR analyzer/93649 11475 * constraint-manager.cc (constraint_manager::add_constraint): When 11476 merging equivalence classes and updating m_constant, also update 11477 m_cst_sid. 11478 (constraint_manager::validate): If m_constant is non-NULL assert 11479 that m_cst_sid is non-null and is valid. 11480 11481 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11482 11483 PR analyzer/93657 11484 * analyzer.opt (fdump-analyzer): Reword description. 11485 (fdump-analyzer-stderr): Likewise. 11486 11487 2020-02-11 David Malcolm <dmalcolm (a] redhat.com> 11488 11489 * region-model.cc (print_quoted_type): New function. 11490 (svalue::print): Use it to replace %qT. 11491 (region::dump_to_pp): Likewise. 11492 (region::dump_child_label): Likewise. 11493 (region::print_fields): Likewise. 11494 11495 2020-02-10 David Malcolm <dmalcolm (a] redhat.com> 11496 11497 PR analyzer/93659 11498 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha" 11499 -> "that" typo. 11500 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" -> 11501 "uninitialized" typo. 11502 11503 2020-02-10 David Malcolm <dmalcolm (a] redhat.com> 11504 11505 PR analyzer/93350 11506 * region-model.cc (region_model::get_lvalue_1): 11507 Handle BIT_FIELD_REF. 11508 (make_region_for_type): Handle VECTOR_TYPE. 11509 11510 2020-02-10 David Malcolm <dmalcolm (a] redhat.com> 11511 11512 PR analyzer/93647 11513 * diagnostic-manager.cc 11514 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against 11515 VAR being constant. 11516 * region-model.cc (region_model::get_lvalue_1): Provide a better 11517 error message when encountering an unhandled tree code. 11518 11519 2020-02-10 David Malcolm <dmalcolm (a] redhat.com> 11520 11521 PR analyzer/93405 11522 * region-model.cc (region_model::get_lvalue_1): Implement 11523 CONST_DECL. 11524 11525 2020-02-06 David Malcolm <dmalcolm (a] redhat.com> 11526 11527 * region-model.cc (region_model::maybe_cast_1): Attempt to provide 11528 a region_svalue if either type is a pointer, rather than if both 11529 types are pointers. 11530 11531 2020-02-05 David Malcolm <dmalcolm (a] redhat.com> 11532 11533 * engine.cc (exploded_node::dump_dot): Show merger enodes. 11534 (worklist::add_node): Assert that the node's m_status is 11535 STATUS_WORKLIST. 11536 (exploded_graph::process_worklist): Likewise for nodes from the 11537 worklist. Set status of merged nodes to STATUS_MERGER. 11538 (exploded_graph::process_node): Set status of node to 11539 STATUS_PROCESSED. 11540 (exploded_graph::dump_exploded_nodes): Rework handling of 11541 "__analyzer_dump_exploded_nodes", splitting enodes by status into 11542 "processed" and "merger", showing the count of just the processed 11543 enodes at the call, rather than the count of all enodes. 11544 * exploded-graph.h (exploded_node::status): New enum. 11545 (exploded_node::exploded_node): Initialize m_status to 11546 STATUS_WORKLIST. 11547 (exploded_node::get_status): New getter. 11548 (exploded_node::set_status): New setter. 11549 11550 2020-02-04 David Malcolm <dmalcolm (a] redhat.com> 11551 11552 PR analyzer/93543 11553 * engine.cc (pod_hash_traits<function_call_string>::mark_empty): 11554 Eliminate reinterpret_cast. 11555 (pod_hash_traits<function_call_string>::is_empty): Likewise. 11556 11557 2020-02-03 David Malcolm <dmalcolm (a] redhat.com> 11558 11559 * constraint-manager.cc (range::constrained_to_single_element): 11560 Replace fold_build2 with fold_binary. Remove unnecessary newline. 11561 (constraint_manager::get_or_add_equiv_class): Replace fold_build2 11562 with fold_binary in two places, and remove out-of-date comment. 11563 (constraint_manager::eval_condition): Replace fold_build2 with 11564 fold_binary. 11565 * region-model.cc (constant_svalue::eval_condition): Likewise. 11566 (region_model::on_assignment): Likewise. 11567 11568 2020-02-03 David Malcolm <dmalcolm (a] redhat.com> 11569 11570 PR analyzer/93544 11571 * diagnostic-manager.cc 11572 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof 11573 against bad choices due to bad paths. 11574 * engine.cc (impl_region_model_context::on_phi): New. 11575 * exploded-graph.h (impl_region_model_context::on_phi): New decl. 11576 * region-model.cc (region_model::on_longjmp): Likewise. 11577 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi 11578 vfunc. 11579 (region_model::update_for_phis): Pass phi to handle_phi. 11580 * region-model.h (region_model::handle_phi): Add phi param. 11581 (region_model_context::on_phi): New vfunc. 11582 (test_region_model_context::on_phi): New. 11583 * sm-malloc.cc (malloc_state_machine::on_phi): New. 11584 (malloc_state_machine::on_zero_assignment): New. 11585 * sm.h (state_machine::on_phi): New vfunc. 11586 11587 2020-02-03 David Malcolm <dmalcolm (a] redhat.com> 11588 11589 * engine.cc (supernode_cluster::dump_dot): Show BB index as 11590 well as SN index. 11591 * supergraph.cc (supernode::dump_dot): Likewise. 11592 11593 2020-02-03 David Malcolm <dmalcolm (a] redhat.com> 11594 11595 PR analyzer/93546 11596 * region-model.cc (region_model::on_call_pre): Update for new 11597 param of symbolic_region ctor. 11598 (region_model::deref_rvalue): Likewise. 11599 (region_model::add_new_malloc_region): Likewise. 11600 (make_region_for_type): Likewise, preserving type. 11601 * region-model.h (symbolic_region::symbolic_region): Add "type" 11602 param and pass it to base class ctor. 11603 11604 2020-02-03 David Malcolm <dmalcolm (a] redhat.com> 11605 11606 PR analyzer/93547 11607 * constraint-manager.cc 11608 (constraint_manager::get_or_add_equiv_class): Ensure types are 11609 compatible before comparing constants. 11610 11611 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11612 11613 PR analyzer/93457 11614 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather 11615 than checking against void_type_node. 11616 11617 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11618 11619 PR analyzer/93373 11620 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to... 11621 (assert_compat_types): ...this, and bail when either type is NULL, 11622 or when VOID_TYPE_P (dst_type). 11623 (region_model::get_lvalue): Update for above conversion. 11624 (region_model::get_rvalue): Likewise. 11625 11626 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11627 11628 PR analyzer/93379 11629 * region-model.cc (region_model::update_for_return_superedge): 11630 Move check for null result so that it also guards setting the 11631 lhs. 11632 11633 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11634 11635 PR analyzer/93438 11636 * region-model.cc (stack_region::can_merge_p): Split into a two 11637 pass approach, creating all stack regions first, then populating 11638 them. 11639 (selftest::test_state_merging): Add test coverage for (a) the case 11640 of self-merging a model in which a local in an older stack frame 11641 points to a local in a more recent stack frame (which previously 11642 would ICE), and (b) the case of self-merging a model in which a 11643 local points to a global (which previously worked OK). 11644 11645 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11646 11647 * analyzer.cc (is_named_call_p): Replace tests for fndecl being 11648 extern at file scope and having a non-NULL DECL_NAME with a call 11649 to maybe_special_function_p. 11650 * function-set.cc (function_set::contains_decl_p): Add call to 11651 maybe_special_function_p. 11652 11653 2020-01-31 David Malcolm <dmalcolm (a] redhat.com> 11654 11655 PR analyzer/93450 11656 * constraint-manager.cc 11657 (constraint_manager::get_or_add_equiv_class): Only compare constants 11658 if their types are compatible. 11659 * region-model.cc (constant_svalue::eval_condition): Replace check 11660 for identical types with call to types_compatible_p. 11661 11662 2020-01-30 David Malcolm <dmalcolm (a] redhat.com> 11663 11664 * program-state.cc (extrinsic_state::dump_to_pp): New. 11665 (extrinsic_state::dump_to_file): New. 11666 (extrinsic_state::dump): New. 11667 * program-state.h (extrinsic_state::dump_to_pp): New decl. 11668 (extrinsic_state::dump_to_file): New decl. 11669 (extrinsic_state::dump): New decl. 11670 * sm.cc: Include "pretty-print.h". 11671 (state_machine::dump_to_pp): New. 11672 * sm.h (state_machine::dump_to_pp): New decl. 11673 11674 2020-01-30 David Malcolm <dmalcolm (a] redhat.com> 11675 11676 * diagnostic-manager.cc (for_each_state_change): Use 11677 extrinsic_state::get_num_checkers rather than accessing m_checkers 11678 directly. 11679 * program-state.cc (program_state::program_state): Likewise. 11680 * program-state.h (extrinsic_state::m_checkers): Make private. 11681 11682 2020-01-30 David Malcolm <dmalcolm (a] redhat.com> 11683 11684 PR analyzer/93356 11685 * region-model.cc (region_model::eval_condition): In both 11686 overloads, bail out immediately on floating-point types. 11687 (region_model::eval_condition_without_cm): Likewise. 11688 (region_model::add_constraint): Likewise. 11689 11690 2020-01-30 David Malcolm <dmalcolm (a] redhat.com> 11691 11692 PR analyzer/93450 11693 * program-state.cc (sm_state_map::set_state): For the overload 11694 taking an svalue_id, bail out if the set_state on the ec does 11695 nothing. Convert the latter's return type from void to bool, 11696 returning true if anything changed. 11697 (sm_state_map::impl_set_state): Convert the return type from void 11698 to bool, returning true if the state changed. 11699 * program-state.h (sm_state_map::set_state): Convert return type 11700 from void to bool. 11701 (sm_state_map::impl_set_state): Likewise. 11702 * region-model.cc (constant_svalue::eval_condition): Only call 11703 fold_build2 if the types are the same. 11704 11705 2020-01-29 Jakub Jelinek <jakub (a] redhat.com> 11706 11707 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove. 11708 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h. 11709 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or 11710 POP_IGNORE_WFORMAT. 11711 * state-purge.cc: Include diagnostic-core.h before 11712 gimple-pretty-print.h. 11713 (state_purge_annotator::add_node_annotations, print_vec_of_names): 11714 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT. 11715 * region-model.cc: Move diagnostic-core.h include before graphviz.h. 11716 (path_var::dump, svalue::print, constant_svalue::print_details, 11717 region::dump_to_pp, region::dump_child_label, region::print_fields, 11718 map_region::print_fields, map_region::dump_dot_to_pp, 11719 map_region::dump_child_label, array_region::print_fields, 11720 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or 11721 POP_IGNORE_WFORMAT. 11722 11723 2020-01-28 David Malcolm <dmalcolm (a] redhat.com> 11724 11725 PR analyzer/93316 11726 * engine.cc (rewind_info_t::update_model): Get the longjmp call 11727 stmt via get_longjmp_call () rather than assuming it is the last 11728 stmt in the longjmp's supernode. 11729 (rewind_info_t::add_events_to_path): Get the location_t for the 11730 rewind_from_longjmp_event via get_longjmp_call () rather than from 11731 the supernode's get_end_location (). 11732 11733 2020-01-28 David Malcolm <dmalcolm (a] redhat.com> 11734 11735 * region-model.cc (poisoned_value_diagnostic::emit): Update for 11736 renaming of warning_at overload to warning_meta. 11737 * sm-file.cc (file_leak::emit): Likewise. 11738 * sm-malloc.cc (double_free::emit): Likewise. 11739 (possible_null_deref::emit): Likewise. 11740 (possible_null_arg::emit): Likewise. 11741 (null_deref::emit): Likewise. 11742 (null_arg::emit): Likewise. 11743 (use_after_free::emit): Likewise. 11744 (malloc_leak::emit): Likewise. 11745 (free_of_non_heap::emit): Likewise. 11746 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise. 11747 * sm-signal.cc (signal_unsafe_call::emit): Likewise. 11748 * sm-taint.cc (tainted_array_index::emit): Likewise. 11749 11750 2020-01-27 David Malcolm <dmalcolm (a] redhat.com> 11751 11752 PR analyzer/93451 11753 * region-model.cc (tree_cmp): For the REAL_CST case, impose an 11754 arbitrary order on NaNs relative to other NaNs and to non-NaNs; 11755 const-correctness tweak. 11756 (ana::selftests::build_real_cst_from_string): New function. 11757 (ana::selftests::append_interesting_constants): New function. 11758 (ana::selftests::test_tree_cmp_on_constants): New test. 11759 (ana::selftests::test_canonicalization_4): New test. 11760 (ana::selftests::analyzer_region_model_cc_tests): Call the new 11761 tests. 11762 11763 2020-01-27 David Malcolm <dmalcolm (a] redhat.com> 11764 11765 PR analyzer/93349 11766 * engine.cc (run_checkers): Save and restore input_location. 11767 11768 2020-01-27 David Malcolm <dmalcolm (a] redhat.com> 11769 11770 * call-string.cc (call_string::cmp_1): Delete, moving body to... 11771 (call_string::cmp): ...here. 11772 * call-string.h (call_string::cmp_1): Delete decl. 11773 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to... 11774 (worklist::key_t::cmp): ...here. Implement hash comparisons 11775 via comparison rather than subtraction to avoid overflow issues. 11776 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl. 11777 * region-model.cc (tree_cmp): Eliminate buggy checking for 11778 symmetry. 11779 11780 2020-01-27 David Malcolm <dmalcolm (a] redhat.com> 11781 11782 * analyzer.cc (is_named_call_p): Check that fndecl is "extern" 11783 and at file scope. Potentially disregard prefix _ or __ in 11784 fndecl's name. Bail if the identifier is NULL. 11785 (is_setjmp_call_p): Expect a gcall rather than plain gimple. 11786 Remove special-case check for leading prefix, and also check for 11787 sigsetjmp. 11788 (is_longjmp_call_p): Also check for siglongjmp. 11789 (get_user_facing_name): New function. 11790 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain 11791 gimple. 11792 (get_user_facing_name): New decl. 11793 * checker-path.cc (setjmp_event::get_desc): Use 11794 get_user_facing_name to avoid hardcoding the function name. 11795 (rewind_event::rewind_event): Add rewind_info param, using it to 11796 initialize new m_rewind_info field, and strengthen the assertion. 11797 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to 11798 avoid hardcoding the function name. 11799 (rewind_to_setjmp_event::get_desc): Likewise. 11800 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call 11801 param and use it to initialize... 11802 (setjmp_event::m_setjmp_call): New field. 11803 (rewind_event::rewind_event): Add rewind_info param. 11804 (rewind_event::m_rewind_info): New protected field. 11805 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add 11806 rewind_info param. 11807 (class rewind_to_setjmp_event): Move rewind_info field to parent 11808 class. 11809 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge): 11810 Update setjmp-handling for is_setjmp_call_p requiring a gcall; 11811 pass the call to the new setjmp_event. 11812 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p 11813 requiring a gcall. 11814 (stale_jmp_buf::emit): Use get_user_facing_name to avoid 11815 hardcoding the function names. 11816 (exploded_node::on_longjmp): Pass the longjmp_call when 11817 constructing rewind_info. 11818 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the 11819 rewind_from_longjmp_event's ctor. 11820 * exploded-graph.h (rewind_info_t::rewind_info_t): Add 11821 longjmp_call param. 11822 (rewind_info_t::get_longjmp_call): New. 11823 (rewind_info_t::m_longjmp_call): New. 11824 * region-model.cc (region_model::on_setjmp): Update comment to 11825 indicate this is also for sigsetjmp. 11826 * region-model.h (struct setjmp_record): Likewise. 11827 (class setjmp_svalue): Likewise. 11828 11829 2020-01-27 David Malcolm <dmalcolm (a] redhat.com> 11830 11831 PR analyzer/93276 11832 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these 11833 macros with GCC_VERSION >= 4006, making them no-op otherwise. 11834 * engine.cc (exploded_edge::exploded_edge): Specify template for 11835 base class initializer. 11836 (exploded_graph::add_edge): Specify template when chaining up to 11837 base class add_edge implementation. 11838 (viz_callgraph_node::dump_dot): Drop redundant "typename". 11839 (viz_callgraph_edge::viz_callgraph_edge): Specify template for 11840 base class initializer. 11841 * program-state.cc (sm_state_map::clone_with_remapping): Drop 11842 redundant "typename". 11843 (sm_state_map::print): Likewise. 11844 (sm_state_map::hash): Likewise. 11845 (sm_state_map::operator==): Likewise. 11846 (sm_state_map::remap_svalue_ids): Likewise. 11847 (sm_state_map::on_svalue_purge): Likewise. 11848 (sm_state_map::validate): Likewise. 11849 * program-state.h (sm_state_map::iterator_t): Likewise. 11850 * supergraph.h (superedge::superedge): Specify template for base 11851 class initializer. 11852 11853 2020-01-23 David Malcolm <dmalcolm (a] redhat.com> 11854 11855 PR analyzer/93375 11856 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail 11857 gracefully is the number of parameters at the callee exceeds the 11858 number of arguments at the call stmt. 11859 (callgraph_superedge::get_parm_for_arg): Likewise. 11860 11861 2020-01-22 David Malcolm <dmalcolm (a] redhat.com> 11862 11863 PR analyzer/93382 11864 * program-state.cc (sm_state_map::on_svalue_purge): If the 11865 entry survives, but the origin is being purged, then reset the 11866 origin to null. 11867 11868 2020-01-22 David Malcolm <dmalcolm (a] redhat.com> 11869 11870 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana. 11871 11872 2020-01-22 David Malcolm <dmalcolm (a] redhat.com> 11873 11874 PR analyzer/93378 11875 * engine.cc (setjmp_svalue::compare_fields): Update for 11876 replacement of m_enode with m_setjmp_record. 11877 (setjmp_svalue::add_to_hash): Likewise. 11878 (setjmp_svalue::get_index): Rename... 11879 (setjmp_svalue::get_enode_index): ...to this. 11880 (setjmp_svalue::print_details): Update for replacement of m_enode 11881 with m_setjmp_record. 11882 (exploded_node::on_longjmp): Likewise. 11883 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace... 11884 (rewind_info_t::m_setjmp_record): ...with this. 11885 (rewind_info_t::rewind_info_t): Update for replacement of m_enode 11886 with m_setjmp_record. 11887 (rewind_info_t::get_setjmp_point): Likewise. 11888 (rewind_info_t::get_setjmp_call): Likewise. 11889 * region-model.cc (region_model::dump_summary_of_map): Likewise. 11890 (region_model::on_setjmp): Likewise. 11891 * region-model.h (struct setjmp_record): New struct. 11892 (setjmp_svalue::m_enode): Replace... 11893 (setjmp_svalue::m_setjmp_record): ...with this. 11894 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode 11895 with m_setjmp_record. 11896 (setjmp_svalue::clone): Likewise. 11897 (setjmp_svalue::get_index): Rename... 11898 (setjmp_svalue::get_enode_index): ...to this. 11899 (setjmp_svalue::get_exploded_node): Replace... 11900 (setjmp_svalue::get_setjmp_record): ...with this. 11901 11902 2020-01-22 David Malcolm <dmalcolm (a] redhat.com> 11903 11904 PR analyzer/93316 11905 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as 11906 "_setjmp". 11907 11908 2020-01-22 David Malcolm <dmalcolm (a] redhat.com> 11909 11910 PR analyzer/93307 11911 * analysis-plan.h: Wrap everything namespace "ana". 11912 * analyzer-logging.cc: Likewise. 11913 * analyzer-logging.h: Likewise. 11914 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana" 11915 namespace. 11916 * analyzer-selftests.cc: Wrap everything namespace "ana". 11917 * analyzer-selftests.h: Likewise. 11918 * analyzer.h: Likewise for forward decls of types. 11919 * call-string.h: Likewise. 11920 * checker-path.cc: Likewise. 11921 * checker-path.h: Likewise. 11922 * constraint-manager.cc: Likewise. 11923 * constraint-manager.h: Likewise. 11924 * diagnostic-manager.cc: Likewise. 11925 * diagnostic-manager.h: Likewise. 11926 * engine.cc: Likewise. 11927 * engine.h: Likewise. 11928 * exploded-graph.h: Likewise. 11929 * function-set.cc: Likewise. 11930 * function-set.h: Likewise. 11931 * pending-diagnostic.cc: Likewise. 11932 * pending-diagnostic.h: Likewise. 11933 * program-point.cc: Likewise. 11934 * program-point.h: Likewise. 11935 * program-state.cc: Likewise. 11936 * program-state.h: Likewise. 11937 * region-model.cc: Likewise. 11938 * region-model.h: Likewise. 11939 * sm-file.cc: Likewise. 11940 * sm-malloc.cc: Likewise. 11941 * sm-pattern-test.cc: Likewise. 11942 * sm-sensitive.cc: Likewise. 11943 * sm-signal.cc: Likewise. 11944 * sm-taint.cc: Likewise. 11945 * sm.cc: Likewise. 11946 * sm.h: Likewise. 11947 * state-purge.h: Likewise. 11948 * supergraph.cc: Likewise. 11949 * supergraph.h: Likewise. 11950 11951 2020-01-21 David Malcolm <dmalcolm (a] redhat.com> 11952 11953 PR analyzer/93352 11954 * region-model.cc (int_cmp): Rename to... 11955 (array_region::key_cmp): ...this, using key_t rather than int. 11956 Rewrite in terms of comparisons rather than subtraction to 11957 ensure qsort is anti-symmetric when handling extreme values. 11958 (array_region::walk_for_canonicalization): Update for above 11959 renaming. 11960 * region-model.h (array_region::key_cmp): New decl. 11961 11962 2020-01-17 David Malcolm <dmalcolm (a] redhat.com> 11963 11964 PR analyzer/93290 11965 * region-model.cc (region_model::eval_condition_without_cm): Avoid 11966 gcc_unreachable for unexpected operations for the case where 11967 we're comparing an svalue against itself. 11968 11969 2020-01-17 David Malcolm <dmalcolm (a] redhat.com> 11970 11971 PR analyzer/93281 11972 * region-model.cc 11973 (region_model::convert_byte_offset_to_array_index): Convert to 11974 ssizetype before dividing by byte_size. Use fold_binary rather 11975 than fold_build2 to avoid needlessly constructing a tree for the 11976 non-const case. 11977 11978 2020-01-15 David Malcolm <dmalcolm (a] redhat.com> 11979 11980 * engine.cc (class impl_region_model_context): Fix comment. 11981 11982 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 11983 11984 PR analyzer/93212 11985 * region-model.cc (make_region_for_type): Use 11986 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE. 11987 * region-model.h (function_region::function_region): Likewise. 11988 11989 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 11990 11991 * program-state.cc (sm_state_map::clone_with_remapping): Copy 11992 m_global_state. 11993 (selftest::test_program_state_merging_2): New selftest. 11994 (selftest::analyzer_program_state_cc_tests): Call it. 11995 11996 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 11997 11998 * checker-path.h (checker_path::get_checker_event): New function. 11999 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private. 12000 * diagnostic-manager.cc 12001 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct 12002 access to checker_path::m_events with accessor functions. Fix 12003 overlong line. 12004 (diagnostic_manager::prune_interproc_events): Replace direct 12005 access to checker_path::m_events with accessor functions. 12006 (diagnostic_manager::finish_pruning): Likewise. 12007 12008 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12009 12010 * checker-path.h (checker_event::clone): Delete vfunc decl. 12011 (debug_event::clone): Delete vfunc impl. 12012 (custom_event::clone): Delete vfunc impl. 12013 (statement_event::clone): Delete vfunc impl. 12014 (function_entry_event::clone): Delete vfunc impl. 12015 (state_change_event::clone): Delete vfunc impl. 12016 (start_cfg_edge_event::clone): Delete vfunc impl. 12017 (end_cfg_edge_event::clone): Delete vfunc impl. 12018 (call_event::clone): Delete vfunc impl. 12019 (return_event::clone): Delete vfunc impl. 12020 (setjmp_event::clone): Delete vfunc impl. 12021 (rewind_from_longjmp_event::clone): Delete vfunc impl. 12022 (rewind_to_setjmp_event::clone): Delete vfunc impl. 12023 (warning_event::clone): Delete vfunc impl. 12024 12025 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12026 12027 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE 12028 element has at least one TR. 12029 12030 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12031 12032 PR analyzer/58237 12033 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location 12034 when comparing against UNKNOWN_LOCATION. 12035 (stmt_requires_new_enode_p): Likewise. 12036 (exploded_graph::dump_exploded_nodes): Likewise. 12037 * supergraph.cc (supernode::get_start_location): Likewise. 12038 (supernode::get_end_location): Likewise. 12039 12040 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12041 12042 PR analyzer/58237 12043 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 12044 selftest::analyzer_sm_file_cc_tests. 12045 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New 12046 decl. 12047 * sm-file.cc: Include "analyzer/function-set.h" and 12048 "analyzer/analyzer-selftests.h". 12049 (get_file_using_fns): New function. 12050 (is_file_using_fn_p): New function. 12051 (fileptr_state_machine::on_stmt): Return true for known functions. 12052 (selftest::analyzer_sm_file_cc_tests): New function. 12053 12054 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12055 12056 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 12057 selftest::analyzer_sm_signal_cc_tests. 12058 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests): 12059 New decl. 12060 * sm-signal.cc: Include "analyzer/function-set.h" and 12061 "analyzer/analyzer-selftests.h". 12062 (get_async_signal_unsafe_fns): New function. 12063 (signal_unsafe_p): Reimplement in terms of the above. 12064 (selftest::analyzer_sm_signal_cc_tests): New function. 12065 12066 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12067 12068 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call 12069 selftest::analyzer_function_set_cc_tests. 12070 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests): 12071 New decl. 12072 * function-set.cc: New file. 12073 * function-set.h: New file. 12074 12075 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12076 12077 * analyzer.h (fndecl_has_gimple_body_p): New decl. 12078 * engine.cc (impl_region_model_context::on_unknown_change): New 12079 function. 12080 (fndecl_has_gimple_body_p): Make non-static. 12081 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as 12082 known. Track whether we have a call with unknown side-effects and 12083 pass it to on_call_post. 12084 * exploded-graph.h (impl_region_model_context::on_unknown_change): 12085 New decl. 12086 * program-state.cc (sm_state_map::on_unknown_change): New function. 12087 * program-state.h (sm_state_map::on_unknown_change): New decl. 12088 * region-model.cc: Include "bitmap.h". 12089 (region_model::on_call_pre): Return a bool, capturing whether the 12090 call has unknown side effects. 12091 (region_model::on_call_post): Add arg "bool unknown_side_effects" 12092 and if true, call handle_unrecognized_call. 12093 (class reachable_regions): New class. 12094 (region_model::handle_unrecognized_call): New function. 12095 * region-model.h (region_model::on_call_pre): Return a bool. 12096 (region_model::on_call_post): Add arg "bool unknown_side_effects". 12097 (region_model::handle_unrecognized_call): New decl. 12098 (region_model_context::on_unknown_change): New vfunc. 12099 (test_region_model_context::on_unknown_change): New function. 12100 12101 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12102 12103 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here 12104 from header. Replace pointer equality test on m_var with call to 12105 pending_diagnostic::same_tree_p. 12106 * diagnostic-manager.h (saved_diagnostic::operator==): Move to 12107 diagnostic-manager.cc. 12108 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New. 12109 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New. 12110 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer 12111 equality on m_arg with call to pending_diagnostic::same_tree_p. 12112 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise. 12113 (possible_null_arg::subclass_equal_p): Likewise. 12114 (null_arg::subclass_equal_p): Likewise. 12115 (free_of_non_heap::subclass_equal_p): Likewise. 12116 * sm-pattern-test.cc (pattern_match::operator==): Likewise. 12117 * sm-sensitive.cc (exposure_through_output_file::operator==): 12118 Likewise. 12119 * sm-taint.cc (tainted_array_index::operator==): Likewise. 12120 12121 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12122 12123 * diagnostic-manager.cc (dedupe_winners::add): Add logging 12124 of deduplication decisions made. 12125 12126 2020-01-14 David Malcolm <dmalcolm (a] redhat.com> 12127 12128 * ChangeLog: New file. 12129 * analyzer-selftests.cc: New file. 12130 * analyzer-selftests.h: New file. 12131 * analyzer.opt: New file. 12132 * analysis-plan.cc: New file. 12133 * analysis-plan.h: New file. 12134 * analyzer-logging.cc: New file. 12135 * analyzer-logging.h: New file. 12136 * analyzer-pass.cc: New file. 12137 * analyzer.cc: New file. 12138 * analyzer.h: New file. 12139 * call-string.cc: New file. 12140 * call-string.h: New file. 12141 * checker-path.cc: New file. 12142 * checker-path.h: New file. 12143 * constraint-manager.cc: New file. 12144 * constraint-manager.h: New file. 12145 * diagnostic-manager.cc: New file. 12146 * diagnostic-manager.h: New file. 12147 * engine.cc: New file. 12148 * engine.h: New file. 12149 * exploded-graph.h: New file. 12150 * pending-diagnostic.cc: New file. 12151 * pending-diagnostic.h: New file. 12152 * program-point.cc: New file. 12153 * program-point.h: New file. 12154 * program-state.cc: New file. 12155 * program-state.h: New file. 12156 * region-model.cc: New file. 12157 * region-model.h: New file. 12158 * sm-file.cc: New file. 12159 * sm-malloc.cc: New file. 12160 * sm-malloc.dot: New file. 12161 * sm-pattern-test.cc: New file. 12162 * sm-sensitive.cc: New file. 12163 * sm-signal.cc: New file. 12164 * sm-taint.cc: New file. 12165 * sm.cc: New file. 12166 * sm.h: New file. 12167 * state-purge.cc: New file. 12168 * state-purge.h: New file. 12169 * supergraph.cc: New file. 12170 * supergraph.h: New file. 12171 12172 2019-12-13 David Malcolm <dmalcolm (a] redhat.com> 12173 12174 * Initial creation 12175 12176 12178 Copyright (C) 2019-2024 Free Software Foundation, Inc. 12179 12180 Copying and distribution of this file, with or without modification, 12181 are permitted in any medium without royalty provided the copyright 12182 notice and this notice are preserved. 12183
Indexes created Sat Apr 25 00:22:52 UTC 2026