aboutsummaryrefslogtreecommitdiff
path: root/gcc/analyzer
AgeCommit message (Collapse)AuthorFilesLines
2020-12-01Daily bump.GCC Administrator1-0/+27
2020-11-30Unbreak build with --disable-analyzerDavid Malcolm1-0/+3
I broke the build with --disable-analyzer with g:66dde7bc64b75d4a338266333c9c490b12d49825, due to: ../../src/gcc/analyzer/analyzer-pass.cc: In member function ‘virtual unsigned int {anonymous}::pass_analyzer::execute(function*)’: ../../src/gcc/analyzer/analyzer-pass.cc:86:3: error: ‘sorry_no_analyzer’ was not declared in this scope 86 | sorry_no_analyzer (); | ^~~~~~~~~~~~~~~~~ Fixed by including the relevant header file. Sorry about the breakage. gcc/analyzer/ChangeLog: * analyzer-pass.cc: Include "analyzer/analyzer.h" for the declaration of sorry_no_analyzer; include "tree.h" and "function.h" as these are needed by it.
2020-11-30Add analyzer plugin support and CPython GIL exampleDavid Malcolm7-4/+88
This patch adds a new GCC plugin event: PLUGIN_ANALYZER_INIT, called when -fanalyzer is starting, allowing for GCC plugins to register additional state-machine-based checks within -fanalyzer. The idea is that 3rd-party code might want to add domain-specific checks for its own APIs - with the caveat that the analyzer is itself still rather experimental. As an example, the patch adds a proof-of-concept plugin to the testsuite for checking CPython code: verifying that code that relinquishes CPython's global interpreter lock doesn't attempt to do anything with PyObjects in the sections where the lock isn't held. It also adds a warning about nested releases of the lock, which is forbidden. For example: demo.c: In function 'foo': demo.c:11:3: warning: use of PyObject '*(obj)' without the GIL 11 | Py_INCREF (obj); | ^~~~~~~~~ 'test': events 1-3 | | 15 | void test (PyObject *obj) | | ^~~~ | | | | | (1) entry to 'test' | 16 | { | 17 | Py_BEGIN_ALLOW_THREADS | | ~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) releasing the GIL here | 18 | foo (obj); | | ~~~~~~~~~ | | | | | (3) calling 'foo' from 'test' | +--> 'foo': events 4-5 | | 9 | foo (PyObject *obj) | | ^~~ | | | | | (4) entry to 'foo' | 10 | { | 11 | Py_INCREF (obj); | | ~~~~~~~~~ | | | | | (5) PyObject '*(obj)' used here without the GIL | Doing so requires adding some logic for ignoring macro expansions in analyzer diagnostics, since the insides of Py_INCREF and Py_BEGIN_ALLOW_THREADS are not of interest to the user for these cases. gcc/analyzer/ChangeLog: * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to... (sorry_no_analyzer): New. * analyzer.h (class state_machine): New forward decl. (class logger): New forward decl. (class plugin_analyzer_init_iface): New. (sorry_no_analyzer): New decl. * checker-path.cc (checker_path::fixup_locations): New. * checker-path.h (checker_event::set_location): New. (checker_path::fixup_locations): New decl. * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostic): Call checker_path::fixup_locations, and call fixup_location on the primary location. * engine.cc: Include "plugin.h". (class plugin_analyzer_init_impl): New. (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks. * pending-diagnostic.h (pending_diagnostic::fixup_location): New vfunc. gcc/ChangeLog: * doc/plugins.texi (Plugin callbacks): Add PLUGIN_ANALYZER_INIT. * plugin.c (register_callback): Likewise. (invoke_plugin_callbacks_full): Likewise. * plugin.def (PLUGIN_ANALYZER_INIT): New event. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_gil_plugin.c: New test. * gcc.dg/plugin/gil-1.c: New test. * gcc.dg/plugin/gil.h: New header. * gcc.dg/plugin/plugin.exp (plugin_test_list): Add the new plugin and test.
2020-11-19Daily bump.GCC Administrator1-0/+7
2020-11-18analyzer: only use CWE-690 for unchecked return value [PR97893]David Malcolm1-4/+4
CWE-690 is only for dereferencing an unchecked return value; for other kinds of NULL dereference, use the parent classification, CWE-476. gcc/analyzer/ChangeLog: PR analyzer/97893 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than CWE-690, as this isn't due to an unchecked return value. (null_arg::emit): Likewise. gcc/testsuite/ChangeLog: PR analyzer/97893 * gcc.dg/analyzer/malloc-1.c: Add CWE-690 and CWE-476 codes to expected output.
2020-11-13Daily bump.GCC Administrator1-0/+35
2020-11-11analyzer: precision-of-wording for -Wanalyzer-stale-setjmp-bufferDavid Malcolm4-5/+89
This patch adds a custom event to paths emitted by -Wanalyzer-stale-setjmp-buffer highlighting the place where the pertinent stack frame is popped, and updates the final event in the path to reference this. gcc/analyzer/ChangeLog: * checker-path.h (checker_event::get_id_ptr): New. * diagnostic-manager.cc (path_builder::path_builder): Add "sd" param and use it to initialize new field "m_sd". (path_builder::get_pending_diagnostic): New. (path_builder::m_sd): New field. (diagnostic_manager::emit_saved_diagnostic): Pass sd to path_builder ctor. (diagnostic_manager::add_events_for_superedge): Call new maybe_add_custom_events_for_superedge vfunc. * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point" param and use it to initialize new field "m_setjmp_point". Initialize new field "m_stack_pop_event". (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc implementation. (stale_jmp_buf::describe_final_event): New vfunc implementation. (stale_jmp_buf::m_setjmp_point): New field. (stale_jmp_buf::m_stack_pop_event): New field. (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf ctor. * pending-diagnostic.h (pending_diagnostic::maybe_add_custom_events_for_superedge): New vfunc. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/setjmp-5.c: Update expected path output to show an event where the pertinent stack frame is popped. Update expected message from final event to reference this event.
2020-11-11analyzer: warn on invalid shift counts [PR97424]David Malcolm2-0/+110
This patch implements -Wanalyzer-shift-count-negative and -Wanalyzer-shift-count-overflow, analogous to the C/C++ warnings -Wshift-count-negative and -Wshift-count-overflow, but implemented via interprocedural path analysis rather than via parsing in a front end, and thus capable of detecting interprocedural cases that the warnings implemented in the front ends can miss. gcc/analyzer/ChangeLog: PR tree-optimization/97424 * analyzer.opt (Wanalyzer-shift-count-negative): New. (Wanalyzer-shift-count-overflow): New. * region-model.cc (class shift_count_negative_diagnostic): New. (class shift_count_overflow_diagnostic): New. (region_model::get_gassign_result): Complain about shift counts that are negative or are >= the operand's type's width. gcc/ChangeLog: PR tree-optimization/97424 * doc/invoke.texi (Static Analyzer Options): Add -Wno-analyzer-shift-count-negative and -Wno-analyzer-shift-count-overflow. (-Wno-analyzer-shift-count-negative): New. (-Wno-analyzer-shift-count-overflow): New. gcc/testsuite/ChangeLog: PR tree-optimization/97424 * gcc.dg/analyzer/invalid-shift-1.c: New test.
2020-11-11Daily bump.GCC Administrator1-0/+15
2020-11-10analyzer: remove dead codeMartin Liska7-31/+23
gcc/analyzer/ChangeLog: * constraint-manager.cc (constraint_manager::merge): Remove unused code. * constraint-manager.h: Likewise. * program-state.cc (sm_state_map::sm_state_map): Likewise. (program_state::program_state): Likewise. (test_sm_state_map): Likewise. * program-state.h: Likewise. * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise. * region-model-reachability.h: Likewise. * region-model.cc (region_model::handle_unrecognized_call): Likewise. (region_model::get_reachable_svalues): Likewise. (region_model::can_merge_with_p): Likewise.
2020-11-06Daily bump.GCC Administrator1-0/+5
2020-11-05analyzer: fix ICE comparing COMPLEX_CSTs [PR97668]David Malcolm1-0/+4
gcc/analyzer/ChangeLog: PR analyzer/97668 * svalue.cc (cmp_cst): Handle COMPLEX_CST. gcc/testsuite/ChangeLog: PR analyzer/97668 * gcc.dg/analyzer/pr97668.c: New test. * gfortran.dg/analyzer/pr97668.f: New test.
2020-10-29Daily bump.GCC Administrator1-0/+42
2020-10-28analyzer: more non-determinism fixesDavid Malcolm2-4/+32
gcc/analyzer/ChangeLog: * program-state.cc (sm_state_map::on_liveness_change): Sort the leaking svalues before calling on_state_leak. (program_state::detect_leaks): Likewise when calling on_svalue_leak. * region-model-reachability.cc (reachable_regions::mark_escaped_clusters): Likewise when calling on_escaped_function.
2020-10-28analyzer: fix false leak diagnostic on offsets from malloc [PR97608]David Malcolm1-0/+34
gcc/analyzer/ChangeLog: PR analyzer/97608 * region-model-reachability.cc (reachable_regions::handle_sval): Operands of reachable reversible operations are reachable. gcc/testsuite/ChangeLog: PR analyzer/97608 * gcc.dg/analyzer/malloc-1.c (test_42d): New. * gcc.dg/analyzer/pr97608.c: New test.
2020-10-28analyzer: move svalue and region decls to their own header filesDavid Malcolm8-2162/+2331
gcc/ChangeLog: * Makefile.in (ANALYZER_OBJS): Add analyzer/complexity.o. gcc/analyzer/ChangeLog: * analyzer.h (class state_machine): New forward decl. (class logger): Likewise. (class visitor): Likewise. * complexity.cc: New file, taken from svalue.cc. * complexity.h: New file, taken from region-model.h. * region-model.h: Include "analyzer/svalue.h" and "analyzer/region.h". Move struct complexity to complexity.h. Move svalue, its subclasses and supporting decls to svalue.h. Move region, its subclasses and supporting decls to region.h. * region.cc: Include "analyzer/region.h". (symbolic_region::symbolic_region): Move here from region-model.h. * region.h: New file, based on material from region-model.h. * svalue.cc: Include "analyzer/svalue.h". (complexity::complexity): Move to complexity.cc. (complexity::from_pair): Likewise. * svalue.h: New file, based on material from region-model.h.
2020-10-28analyzer: fix more pointer-printing in logsDavid Malcolm2-5/+11
gcc/analyzer/ChangeLog: * program-state.cc (sm_state_map::print): Guard the printing of the origin pointer with !flag_dump_noaddr. * region.cc (string_region::dump_to_pp): Likewise for m_string_cst.
2020-10-28Daily bump.GCC Administrator1-0/+98
2020-10-27analyzer: don't assume extern const vars are zero-initialized [PR97568]David Malcolm2-2/+6
gcc/analyzer/ChangeLog: PR analyzer/97568 * region-model.cc (region_model::get_initial_value_for_global): Move check that !DECL_EXTERNAL from here to... * region.cc (decl_region::get_svalue_for_initializer): ...here, using it to reject zero initialization. gcc/testsuite/ChangeLog: PR analyzer/97568 * gcc.dg/analyzer/pr97568.c: New test.
2020-10-27analyzer: Change cast from long to intptr_t [PR96608]Markus Böck1-1/+1
Casting to intptr_t states the intent of an integer to pointer cast more clearly and ensures that the cast causes no loss of precision on any platforms. LLP64 platforms eg. have a long value of 4 bytes and pointer values of 8 bytes which may even cause compiler errors. gcc/analyzer/ChangeLog: PR analyzer/96608 * store.h (hash): Cast to intptr_t instead of long
2020-10-27analyzer: eliminate non-deterministic behaviorDavid Malcolm5-31/+102
This patch is a followup to the previous one, eliminating non-determinism in the behavior of the analyzer (rather than just in the logs), by sorting whenever the result previously depended on pointer values. Tested as per the previous patch. gcc/analyzer/ChangeLog: * constraint-manager.cc (svalue_cmp_by_ptr): Delete. (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead. (equiv_class_cmp): Eliminate pointer comparison. * diagnostic-manager.cc (dedupe_key::comparator): If they are at the same location, also compare epath ength and pending_diagnostic kind. * engine.cc (readability_comparator): If two path_vars have the same readability, then impose an arbitrary ordering on them. (worklist::key_t::cmp): If two points have the same plan ordering, continue the comparison. Call sm_state_map::cmp rather than comparing hash values. * program-state.cc (sm_state_map::entry_t::cmp): New. (sm_state_map::cmp): New. * program-state.h (sm_state_map::entry_t::cmp): New decl. (sm_state_map::elements): New. (sm_state_map::cmp): New.
2020-10-27analyzer: eliminate non-determinism in logsDavid Malcolm13-65/+493
This patch and the followup eliminate various forms of non-determinism in the analyzer due to changing pointer values. This patch fixes churn seen when diffing analyzer logs. The patch avoids embedding pointers in various places, and adds sorting when dumping hash_set and hash_map for various analyzer types. Doing so requires implementing a way to sort svalue instances, and assigning UIDs to gimple statements. Tested both patches together via a script that runs a testcase 100 times, and then using diff and md5sum to verify that the results are consistent in the face of address space randomization: FILENAME=$1 rm $FILENAME.* for i in `seq 1 100`; do echo "iteration: $i" ./xgcc -B. -fanalyzer -c ../../src/gcc/testsuite/gcc.dg/analyzer/$FILENAME \ --Wanalyzer-too-complex \ -fdump-analyzer-supergraph \ -fdump-analyzer-exploded-graph \ -fdump-analyzer \ -fdump-noaddr \ -fdump-analyzer-exploded-nodes-2 mv $FILENAME.supergraph.dot $FILENAME.$i.supergraph.dot mv $FILENAME.analyzer.txt $FILENAME.$i.analyzer.txt mv $FILENAME.supergraph-eg.dot $FILENAME.$i.supergraph-eg.dot mv $FILENAME.eg.txt $FILENAME.$i.eg.txt mv $FILENAME.eg.dot $FILENAME.$i.eg.dot done gcc/analyzer/ChangeLog: * engine.cc (setjmp_record::cmp): New. (supernode_cluster::dump_dot): Avoid embedding pointer in cluster name. (supernode_cluster::cmp_ptr_ptr): New. (function_call_string_cluster::dump_dot): Avoid embedding pointer in cluster name. Sort m_map when dumping child clusters. (function_call_string_cluster::cmp_ptr_ptr): New. (root_cluster::dump_dot): Sort m_map when dumping child clusters. * program-point.cc (function_point::cmp): New. (function_point::cmp_ptr): New. * program-point.h (function_point::cmp): New decl. (function_point::cmp_ptr): New decl. * program-state.cc (sm_state_map::print): Sort the values. Guard the printing of pointers with !flag_dump_noaddr. (program_state::prune_for_point): Sort the regions. (log_set_of_svalues): Sort the values. Guard the printing of pointers with !flag_dump_noaddr. * region-model-manager.cc (log_uniq_map): Sort the values. * region-model-reachability.cc (dump_set): New function template. (reachable_regions::dump_to_pp): Use it. * region-model.h (svalue::cmp_ptr): New decl. (svalue::cmp_ptr_ptr): New decl. (setjmp_record::cmp): New decl. (placeholder_svalue::get_name): New accessor. (widening_svalue::get_point): New accessor. (compound_svalue::get_map): New accessor. (conjured_svalue::get_stmt): New accessor. (conjured_svalue::get_id_region): New accessor. (region::cmp_ptrs): Rename to... (region::cmp_ptr_ptr): ...this. * region.cc (region::cmp_ptrs): Rename to... (region::cmp_ptr_ptr): ...this. * state-purge.cc (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort m_points_needing_name when dumping. * store.cc (concrete_binding::cmp_ptr_ptr): New. (symbolic_binding::cmp_ptr_ptr): New. (binding_map::cmp): New. (get_sorted_parent_regions): Update for renaming of region::cmp_ptrs to region::cmp_ptr_ptr. (store::dump_to_pp): Likewise. (store::to_json): Likewise. (store::can_merge_p): Sort the base regions before considering them. * store.h (concrete_binding::cmp_ptr_ptr): New decl. (symbolic_binding::cmp_ptr_ptr): New decl. (binding_map::cmp): New decl. * supergraph.cc (supergraph::supergraph): Assign UIDs to the gimple stmts. * svalue.cc (cmp_cst): New. (svalue::cmp_ptr): New. (svalue::cmp_ptr_ptr): New.
2020-10-27analyzer: fix param "analyzer-max-enodes-per-program-point"David Malcolm1-1/+1
This was effectively checking for one beyond the limit, rather than the limit itself. Seen when fixing PR analyzer/97514. gcc/analyzer/ChangeLog: * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one when imposing param_analyzer_max_enodes_per_program_point limit.
2020-10-27analyzer: implement region_model::get_representative_path_var for labelsDavid Malcolm2-1/+6
This fixes an ICE seen e.g. with gcc.dg/analyzer/data-model-16.c when enabling -fdump-analyzer. gcc/analyzer/ChangeLog: * region-model.cc (region_model::get_representative_path_var): Implement case RK_LABEL. * region-model.h (label_region::get_label): New accessor.
2020-10-23Daily bump.GCC Administrator1-0/+14
2020-10-22analyzer: fix ICE when handling callback exceeds enode limit [PR97514]David Malcolm1-2/+3
gcc/analyzer/ChangeLog: PR analyzer/97514 * engine.cc (exploded_graph::add_function_entry): Handle failure to create an enode, rather than asserting. gcc/testsuite/ChangeLog: PR analyzer/97514 * gcc.dg/analyzer/pr97514.c: New test.
2020-10-22analyzer: fix ICE on dtor [PR97489]David Malcolm1-0/+5
gcc/analyzer/ChangeLog: PR analyzer/97489 * engine.cc (exploded_graph::add_function_entry): Assert that we have a function body. (exploded_graph::on_escaped_function): Reject fndecls that don't have a function body. gcc/testsuite/ChangeLog: PR analyzer/97489 * g++.dg/analyzer/pr97489.C: New test.
2020-10-15Daily bump.GCC Administrator1-0/+16
2020-10-14analyzer: fix ICE on globals with unknown size [PR93388]David Malcolm2-21/+32
This patch fixes an ICE seen when attempting to build various existing tests in our testsuite with -fanalyzer, including gcc.c-torture/compile/980816-1.c. gcc/analyzer/ChangeLog: PR analyzer/93388 * region-model.cc (region_model::get_initial_value_for_global): Fall back to returning an initial_svalue if decl_region::get_svalue_for_initializer fails. * region.cc (decl_region::get_svalue_for_initializer): Don't attempt to create a compound_svalue if the region has an unknown size. gcc/testsuite/ChangeLog: PR analyzer/93388 * gcc.dg/analyzer/data-model-21.c: New test.
2020-10-14analyzer: fix build with ada [PR93723]David Malcolm1-1/+0
gcc/analyzer/ChangeLog: PR analyzer/93723 * store.cc (binding_map::apply_ctor_to_region): Remove redundant assertion.
2020-10-13Daily bump.GCC Administrator1-0/+55
2020-10-12analyzer: handle static callbacks [PR97258]David Malcolm6-14/+109
The analyzer's initial worklist was only populated with non-static functions in the TU (along with those that look promising for call summaries). Hence some static functions that were never explicitly called but could be called via function pointers were not being analyzed. This patch remedies this by ensuring that functions that escape as function pointers get added to the worklist, if they haven't been already. Another fix would be to simply analyze all functions that we have a body for, but too much of the testsuite relies on static test functions not being directly analyzed. gcc/analyzer/ChangeLog: PR analyzer/97258 * engine.cc (impl_region_model_context::on_escaped_function): New vfunc. (exploded_graph::add_function_entry): Use m_functions_with_enodes to implement idempotency. (add_any_callbacks): New. (exploded_graph::build_initial_worklist): Use the above to find callbacks that are reachable from global initializers. (exploded_graph::on_escaped_function): New. * exploded-graph.h (impl_region_model_context::on_escaped_function): New decl. (exploded_graph::on_escaped_function): New decl. (exploded_graph::m_functions_with_enodes): New field. * region-model-reachability.cc (reachable_regions::reachable_regions): Replace "store" param with "model" param; use it to initialize m_model. (reachable_regions::add): When getting the svalue for the region, call get_store_value on the model rather than using an initial value. (reachable_regions::mark_escaped_clusters): Add ctxt param and use it to call on_escaped_function when a function_region escapes. * region-model-reachability.h (reachable_regions::reachable_regions): Replace "store" param with "model" param. (reachable_regions::mark_escaped_clusters): Add ctxt param. (reachable_regions::m_model): New field. * region-model.cc (region_model::handle_unrecognized_call): Update for change in reachable_regions ctor. (region_model::handle_unrecognized_call): Pass ctxt to mark_escaped_clusters. (region_model::get_reachable_svalues): Update for change in reachable_regions ctor. (region_model::get_initial_value_for_global): Read-only variables keep their initial values. * region-model.h (region_model_context::on_escaped_function): New vfunc. (noop_region_model_context::on_escaped_function): New. gcc/testsuite/ChangeLog: PR analyzer/97258 * gcc.dg/analyzer/callbacks-1.c: New test. * gcc.dg/analyzer/callbacks-2.c: New test. * gcc.dg/analyzer/callbacks-3.c: New test.
2020-10-12analyzer: add warnings about writes to constant regions [PR95007]David Malcolm4-1/+133
This patch adds two new warnings: -Wanalyzer-write-to-const -Wanalyzer-write-to-string-literal for code paths where the analyzer detects a write to a constant region. As noted in the documentation part of the patch, the analyzer doesn't prioritize detection of such writes, in that the state-merging logic will blithely lose the distinction between const and non-const regions. Hence false negatives are likely to arise due to state-merging. However, if the analyzer does happen to spot such a write, it seems worth reporting, hence this patch. gcc/analyzer/ChangeLog: * analyzer.opt (Wanalyzer-write-to-const): New. (Wanalyzer-write-to-string-literal): New. * region-model-impl-calls.cc (region_model::impl_call_memcpy): Call check_for_writable_region. (region_model::impl_call_memset): Likewise. (region_model::impl_call_strcpy): Likewise. * region-model.cc (class write_to_const_diagnostic): New. (class write_to_string_literal_diagnostic): New. (region_model::check_for_writable_region): New. (region_model::set_value): Call check_for_writable_region. * region-model.h (region_model::check_for_writable_region): New decl. gcc/ChangeLog: * doc/invoke.texi: Document -Wanalyzer-write-to-const and -Wanalyzer-write-to-string-literal. gcc/testsuite/ChangeLog: PR c/83347 PR middle-end/90404 PR analyzer/95007 * gcc.dg/analyzer/write-to-const-1.c: New test. * gcc.dg/analyzer/write-to-string-literal-1.c: New test.
2020-10-08Daily bump.GCC Administrator1-0/+9
2020-10-07analyzer: handle C++ argument numbers and "this" [PR97116]David Malcolm1-14/+47
gcc/analyzer/ChangeLog: PR analyzer/97116 * sm-malloc.cc (method_p): New. (describe_argument_index): New. (inform_nonnull_attribute): Use describe_argument_index. (possible_null_arg::describe_final_event): Likewise. (null_arg::describe_final_event): Likewise. gcc/testsuite/ChangeLog: PR analyzer/97116 * g++.dg/analyzer/pr97116.C: New test.
2020-09-30Daily bump.GCC Administrator1-0/+14
2020-09-29analyzer: fix signal-handler registration location [PR95188]David Malcolm1-6/+16
PR analyzer/95188 reports that diagnostics from -Wanalyzer-unsafe-call-within-signal-handler use the wrong source location when reporting the signal-handler registration event in the diagnostic_path. The diagnostics erroneously use the location of the first stmt in the basic block containing the call to "signal", rather than that of the call itself. Fixed thusly. gcc/analyzer/ChangeLog: PR analyzer/95188 * engine.cc (stmt_requires_new_enode_p): Split enodes before "signal" calls. gcc/testsuite/ChangeLog: PR analyzer/95188 * gcc.dg/analyzer/signal-registration-loc.c: New test.
2020-09-29analyzer: silence -Wsign-compare warningsDavid Malcolm2-4/+4
gcc/analyzer/ChangeLog: * constraint-manager.cc (constraint_manager::add_constraint_internal): Whitespace fixes. Silence -Wsign-compare warning. * engine.cc (maybe_process_run_of_before_supernode_enodes): Silence -Wsign-compare warning.
2020-09-29Daily bump.GCC Administrator1-0/+25
2020-09-28analyzer: add some missing FINAL OVERRIDEsDavid Malcolm1-4/+16
Spotted by cppcheck. gcc/analyzer/ChangeLog: * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove redundant "virtual". Add FINAL OVERRIDE. (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE. (compound_svalue::dyn_cast_compound_svalue): Likewise. (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
2020-09-28analyzer: remove unused fieldDavid Malcolm1-1/+0
I added this field (and the struct itself) in the rewrite of region and value-handling (808f4dfeb3a95f50f15e71148e5c1067f90a126d), but the field was never used. Found by cppcheck. gcc/analyzer/ChangeLog: * diagnostic-manager.cc (null_assignment_sm_context::m_visitor): Remove unused field.
2020-09-28analyzer: fix ICE on non-pointer longjmp [PR97233]David Malcolm2-1/+5
gcc/analyzer/ChangeLog: PR analyzer/97233 * analyzer.cc (is_longjmp_call_p): Require the initial argument to be a pointer. * engine.cc (exploded_node::on_longjmp): Likewise. gcc/testsuite/ChangeLog: PR analyzer/97233 * gcc.dg/analyzer/pr97233.c: New test.
2020-09-28analyzer: fix sm_state_map::printDavid Malcolm1-1/+1
In 10fc42a8396072912e9d9d940fba25950b3fdfc5 I converted state_t from unsigned to const state *, but missed this comparison against 0. gcc/analyzer/ChangeLog: * program-state.cc (sm_state_map::print): Update check for m_global_state being the start state.
2020-09-27Daily bump.GCC Administrator1-0/+10
2020-09-25analyzer: fix ICEs treeifying offset_region [PR96646, PR96841]David Malcolm1-2/+5
gcc/analyzer/ChangeLog: PR analyzer/96646 PR analyzer/96841 * region-model.cc (region_model::get_representative_path_var): When handling offset_region, wrap the MEM_REF's first argument in an ADDR_EXPR of pointer type, rather than simply using the tree for the parent region. Require the MEM_REF's second argument to be an integer constant. gcc/testsuite/ChangeLog: PR analyzer/96646 PR analyzer/96841 * gcc.dg/analyzer/pr96646.c: New test. * gcc.dg/analyzer/pr96841.c: New test.
2020-09-25Daily bump.GCC Administrator1-0/+50
2020-09-23analyzer: add -fno-analyzer-feasibilityDavid Malcolm9-48/+185
This patch provides a new option "-fno-analyzer-feasibility" as a way to disable feasibility-checking of the constraints along the control flow paths for -fanalyzer diagnostics. I'm adding this in the hope of making it easier to debug issues involving the feasibility-checking logic. The patch adds a new rejected_constraint object which is captured if exploded_path::feasible_p fails, and adds logic that uses this to emit an additional custom_event within the checker_path for the diagnostic, showing where in the control flow path the diagnostic would have been rejected, and giving details of why. gcc/analyzer/ChangeLog: * analyzer.h (struct rejected_constraint): New decl. * analyzer.opt (fanalyzer-feasibility): New option. * diagnostic-manager.cc (path_builder::path_builder): Add "problem" param and use it to initialize new field. (path_builder::get_feasibility_problem): New accessor. (path_builder::m_feasibility_problem): New field. (dedupe_winners::add): Remove inversion of logic in "if" clause, swapping if/else suites. In the !feasible_p suite, inspect flag_analyzer_feasibility and add code to handle when this is off, accepting the infeasible path, but recording the feasibility_problem. (diagnostic_manager::emit_saved_diagnostic): Pass the feasibility_problem to the path_builder. (diagnostic_manager::add_events_for_eedge): If we have a feasibility_problem at this edge, use it to add a custom event. * engine.cc (exploded_path::feasible_p): Pass a rejected_constraint ** to model.maybe_update_for_edge and transfer ownership of any created instance to any feasibility_problem. (feasibility_problem::dump_to_pp): New. * exploded-graph.h (feasibility_problem::feasibility_problem): Drop "model" param; add rejected_constraint * param. (feasibility_problem::~feasibility_problem): New. (feasibility_problem::dump_to_pp): New decl. (feasibility_problem::m_model): Drop field. (feasibility_problem::m_rc): New field. * program-point.cc (function_point::get_location): Handle PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE. * program-state.cc (program_state::on_edge): Pass NULL to new param of region_model::maybe_update_for_edge. * region-model.cc (region_model::add_constraint): New overload adding a rejected_constraint ** param. (region_model::maybe_update_for_edge): Add rejected_constraint ** param and pass it to the various apply_constraints_for_ calls. (region_model::apply_constraints_for_gcond): Add rejected_constraint ** param and pass it to add_constraint calls. (region_model::apply_constraints_for_gswitch): Likewise. (region_model::apply_constraints_for_exception): Likewise. (rejected_constraint::dump_to_pp): New. * region-model.h (region_model::maybe_update_for_edge): Add rejected_constraint ** param. (region_model::add_constraint): New overload adding a rejected_constraint ** param. (region_model::apply_constraints_for_gcond): Add rejected_constraint ** param. (region_model::apply_constraints_for_gswitch): Likewise. (region_model::apply_constraints_for_exception): Likewise. (struct rejected_constraint): New. gcc/ChangeLog: * doc/analyzer.texi (Analyzer Paths): Add note about -fno-analyzer-feasibility. * doc/invoke.texi (Static Analyzer Options): Add -fno-analyzer-feasibility. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/feasibility-2.c: New test.
2020-09-24Daily bump.GCC Administrator1-0/+26
2020-09-23analyzer: fix member call on null seen with ubsan [PR97178]David Malcolm3-8/+10
gcc/analyzer/ChangeLog: PR analyzer/97178 * engine.cc (impl_run_checkers): Update for change to ext_state ctor. * program-state.cc (selftest::test_sm_state_map): Pass an engine instance to ext_state ctor. (selftest::test_program_state_1): Likewise. (selftest::test_program_state_2): Likewise. (selftest::test_program_state_merging): Likewise. (selftest::test_program_state_merging_2): Likewise. * program-state.h (extrinsic_state::extrinsic_state): Remove NULL default value for "eng" param.
2020-09-23gcc/analyzer: Silence -Wpragma warns with GCC < 10Tobias Burnus3-1/+6
gcc/analyzer/ChangeLog: * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"' by '#if __GNUC__ >= 10' * analyzer.h: Likewise. * call-string.cc: Likewise.
generated by cgit v1.1 at 2025-03-03 10:01:35 +0000