analyzer: revamp side-effects of call summaries [PR107072]

With -fanalyzer-call-summaries the analyzer canl attempt to summarize
the effects of some function calls at their call site, rather than
simulate the call directly, which can avoid big slowdowns during
analysis.

Previously, this summarization was extremely simplistic: no attempt
was made to update sm-state, and region_model::update_for_call_summary
would simply set the return value of the function to UNKNOWN, and assume
the function had no side effects.

This patch implements less simplistic summarizations: it tracks each
possible return enode from the called function, and attempts to generate
a successor enode from the callsite for each that have compatible
conditions, mapping state changes in the summary to state changes
at the callsite.  It also implements the beginnings of heuristics for
generating user-facing descriptions of a summary e.g.
  "when 'foo' returns NULL"
versus:
  "when 'foo' returns a heap-allocated buffer"

This still has some bugs, but much more accurately tracks the effects
of a call, and so is an improvement; it should only have an effect
when -fanalyzer-call-summaries is enabled.

As before, -fanalyzer-call-summaries is disabled by default in
analyzer.opt (but enabled by default in the test suite).

gcc/ChangeLog:
	PR analyzer/107072
	* Makefile.in (ANALYZER_OBJS): Add analyzer/call-summary.o.

gcc/analyzer/ChangeLog:
	PR analyzer/107072
	* analyzer-logging.h: Include "diagnostic-core.h".
	* analyzer.h: Include "function.h".
	(class call_summary): New forward decl.
	(class call_summary_replay): New forward decl.
	(struct per_function_data): New forward decl.
	(struct interesting_t): New forward decl.
	(custom_edge_info::update_state): New vfunc.
	* call-info.cc (custom_edge_info::update_state): New.
	* call-summary.cc: New file.
	* call-summary.h: New file.
	* constraint-manager.cc: Include "analyzer/call-summary.h".
	(class replay_fact_visitor): New.
	(constraint_manager::replay_call_summary): New.
	* constraint-manager.h (constraint_manager::replay_call_summary):
	New.
	* engine.cc: Include "analyzer/call-summary.h".
	(exploded_node::on_stmt): Handle call summaries.
	(class call_summary_edge_info): New.
	(exploded_node::replay_call_summaries): New.
	(exploded_node::replay_call_summary): New.
	(per_function_data::~per_function_data): New.
	(per_function_data::add_call_summary): Move here from header and
	reimplement.
	(exploded_graph::process_node): Call update_state rather than
	update_model when handling bifurcation
	(viz_callgraph_node::dump_dot): Use a regular label rather
	than an HTML table; add summaries to dump.
	* exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
	"supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
	"analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
	(exploded_node::replay_call_summaries): New decl.
	(exploded_node::replay_call_summary): New decl.
	(per_function_data::~per_function_data): New decl.
	(per_function_data::add_call_summary): Move implemention from
	header.
	(per_function_data::m_summaries): Update type of element.
	* known-function-manager.h: Include "analyzer/analyzer-logging.h".
	* program-point.h: Include "pretty-print.h" and
	"analyzer/call-string.h".
	* program-state.cc: Include "analyzer/call-summary.h".
	(sm_state_map::replay_call_summary): New.
	(program_state::replay_call_summary): New.
	* program-state.h (sm_state_map::replay_call_summary): New decl.
	(program_state::replay_call_summary): New decl.
	* region-model-manager.cc
	(region_model_manager::get_or_create_asm_output_svalue): New
	overload.
	* region-model-manager.h
	(region_model_manager::get_or_create_asm_output_svalue): New
	overload decl.
	* region-model.cc: Include "analyzer/call-summary.h".
	(region_model::maybe_update_for_edge): Remove call to
	region_model::update_for_call_summary on
	SUPEREDGE_INTRAPROCEDURAL_CALL.
	(region_model::update_for_call_summary): Delete.
	(region_model::replay_call_summary): New.
	* region-model.h (region_model::replay_call_summary): New decl.
	(region_model::update_for_call_summary): Delete decl.
	* store.cc: Include "analyzer/call-summary.h".
	(store::replay_call_summary): New.
	(store::replay_call_summary_cluster): New.
	* store.h: Include "tristate.h".
	(is_a_helper <const ana::concrete_binding *>::test): New.
	(store::replay_call_summary): New decl.
	(store::replay_call_summary_cluster): New decl.
	* supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
	"static" from decl.
	(supergraph_call_edge): Make stmt param const.
	* supergraph.h: Include "ordered-hash-map.h", "cfg.h",
	"basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
	(supergraph_call_edge): Make stmt param const.
	(get_ultimate_function_for_cgraph_edge): New decl.
	* svalue.cc (compound_svalue::compound_svalue): Assert that we're
	not nesting compound_svalues.
	* svalue.h: Include "json.h", "analyzer/store.h", and
	"analyzer/program-point.h".
	(asm_output_svalue::get_num_outputs): New accessor.

gcc/testsuite/ChangeLog:
	PR analyzer/107072
	* gcc.dg/analyzer/call-summaries-2.c: New test.
	* gcc.dg/analyzer/call-summaries-3.c: New test.
	* gcc.dg/analyzer/call-summaries-asm-x86.c: New test.
	* gcc.dg/analyzer/call-summaries-malloc.c: New test.
	* gcc.dg/analyzer/call-summaries-pr107072.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/gcc/analyzer/svalue.h b/gcc/analyzer/svalue.h
index 9393d6e..9d0f04d 100644
--- a/gcc/analyzer/svalue.h
+++ b/gcc/analyzer/svalue.h
@@ -21,7 +21,10 @@ along with GCC; see the file COPYING3.  If not see
 #ifndef GCC_ANALYZER_SVALUE_H
 #define GCC_ANALYZER_SVALUE_H
 
+#include "json.h"
 #include "analyzer/complexity.h"
+#include "analyzer/store.h"
+#include "analyzer/program-point.h"
 
 using namespace ana;
 
@@ -1527,6 +1530,7 @@ public:
 
   const char *get_asm_string () const { return m_asm_string; }
   unsigned get_output_idx () const { return m_output_idx; }
+  unsigned get_num_outputs () const { return m_num_outputs; }
   unsigned get_num_inputs () const { return m_num_inputs; }
   const svalue *get_input (unsigned idx) const { return m_input_arr[idx]; }