aboutsummaryrefslogtreecommitdiff
path: root/gcc/analyzer
AgeCommit message (Collapse)AuthorFilesLines
2020-01-31analyzer: fix ICE with 'const void *' (PR 93457)David Malcolm2-1/+7
gcc/analyzer/ChangeLog: PR analyzer/93457 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather than checking against void_type_node. gcc/testsuite/ChangeLog: PR analyzer/93457 * gcc.dg/analyzer/pr93457.c: New test.
2020-01-31analyzer: fix ICE handling void-type (PR 93373)David Malcolm2-4/+17
gcc/analyzer/ChangeLog: PR analyzer/93373 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to... (assert_compat_types): ...this, and bail when either type is NULL, or when VOID_TYPE_P (dst_type). (region_model::get_lvalue): Update for above conversion. (region_model::get_rvalue): Likewise. gcc/testsuite/ChangeLog: PR analyzer/93373 * gcc.dg/analyzer/torture/pr93373.c: New test.
2020-01-31analyzer: fix ICE getting void return value (PR 93379)David Malcolm2-1/+11
PR analyzer/93379 reports an ICE within region_model::update_for_return_superedge when writing the returned svalue_id to the lhs of the call_stmt The root cause is that this analyzer code assumed that for any call with a non-NULL gimple_call_lhs, the called fndecl would have non-void return type, and thus that a non-null svalue_id would be returned from region_model::pop_frame. This isn't the case e.g. for a call with conflicting types where the callee returns void but the caller assumes int. This patch fixes the ICE by moving the check for null result so that it also guards setting the lhs. gcc/analyzer/ChangeLog: PR analyzer/93379 * region-model.cc (region_model::update_for_return_superedge): Move check for null result so that it also guards setting the lhs. gcc/testsuite/ChangeLog: PR analyzer/93379 * gcc.dg/analyzer/torture/pr93379-2.c: New test. * gcc.dg/analyzer/torture/pr93379.c: New test.
2020-01-31analyzer: fix ICE with pointers between stack frames (PR 93438)David Malcolm2-19/+108
PR analyzer/93438 reports an ICE when merging two region_models in which an older stack frame has a local pointing to a local in a more recent stack frame. stack older frame int *: "ow" --+ | newer frame | int: "pk" <---+ The root cause is that the state-merging code assumes that all frame regions in the merged model have already been created. stack_region::can_merge_p iterates through the frames, creating and populating each merged frame in turn, so when it attempts to populate the older frame, it attempts to reference the newer frame in the merged model, which doesn't exist yet. This patch reworks stack_region::can_merge_p to use a two-pass approach in which all frames in the merged model are created first, and then are all populated, fixing the bug. gcc/analyzer/ChangeLog: PR analyzer/93438 * region-model.cc (stack_region::can_merge_p): Split into a two pass approach, creating all stack regions first, then populating them. (selftest::test_state_merging): Add test coverage for (a) the case of self-merging a model in which a local in an older stack frame points to a local in a more recent stack frame (which previously would ICE), and (b) the case of self-merging a model in which a local points to a global (which previously worked OK). gcc/testsuite/ChangeLog: PR analyzer/93438 * gcc.dg/analyzer/torture/pr93438.c: New test. * gcc.dg/analyzer/torture/pr93438-2.c: New test.
2020-01-31calls.c: refactor special_function_p for use by analyzer (v2)David Malcolm3-9/+11
This patch refactors some code in special_function_p that checks for the function being sane to match by name, splitting it out into a new maybe_special_function_p, and using it it two places in the analyzer. gcc/analyzer/ChangeLog: * analyzer.cc (is_named_call_p): Replace tests for fndecl being extern at file scope and having a non-NULL DECL_NAME with a call to maybe_special_function_p. * function-set.cc (function_set::contains_decl_p): Add call to maybe_special_function_p. gcc/ChangeLog: * calls.c (special_function_p): Split out the check for DECL_NAME being non-NULL and fndecl being extern at file scope into a new maybe_special_function_p and call it. Drop check for fndecl being non-NULL that was after a usage of DECL_NAME (fndecl). * tree.h (maybe_special_function_p): New inline function.
2020-01-31analyzer: further fixes for comparisons between uncomparable types (PR 93450)David Malcolm3-2/+13
gcc/analyzer/ChangeLog: PR analyzer/93450 * constraint-manager.cc (constraint_manager::get_or_add_equiv_class): Only compare constants if their types are compatible. * region-model.cc (constant_svalue::eval_condition): Replace check for identical types with call to types_compatible_p.
2020-01-30analyzer: add extrinsic_state::dumpDavid Malcolm5-0/+68
gcc/analyzer/ChangeLog: * program-state.cc (extrinsic_state::dump_to_pp): New. (extrinsic_state::dump_to_file): New. (extrinsic_state::dump): New. * program-state.h (extrinsic_state::dump_to_pp): New decl. (extrinsic_state::dump_to_file): New decl. (extrinsic_state::dump): New decl. * sm.cc: Include "pretty-print.h". (state_machine::dump_to_pp): New. * sm.h (state_machine::dump_to_pp): New decl.
2020-01-30analyzer: make extrinsic_state field privateDavid Malcolm4-5/+14
gcc/analyzer/ChangeLog: * diagnostic-manager.cc (for_each_state_change): Use extrinsic_state::get_num_checkers rather than accessing m_checkers directly. * program-state.cc (program_state::program_state): Likewise. * program-state.h (extrinsic_state::m_checkers): Make private.
2020-01-30analyzer: fix ICE in __builtin_isnan (PR 93356)David Malcolm2-0/+33
PR analyzer/93356 reports an ICE handling __builtin_isnan due to a failing assertion: 674 gcc_assert (lhs_ec_id != rhs_ec_id); with op=UNORDERED_EXPR. when attempting to add an UNORDERED_EXPR constraint. This is an overzealous assertion, but underlying it are various forms of sloppiness regarding NaN within the analyzer: (a) the assumption in the constraint_manager that equivalence classes are reflexive (X == X), which isn't the case for NaN. (b) Hardcoding the "honor_nans" param to false when calling invert_tree_comparison throughout the analyzer. (c) Ignoring ORDERED_EXPR, UNORDERED_EXPR, and the UN-prefixed comparison codes. I wrote a patch for this which tracks the NaN-ness of floating-point values and uses this to address all of the above. However, to minimize changes in gcc 10 stage 4, here's a simpler patch which rejects attempts to query or add constraints on floating-point values, instead treating any floating-point comparison as "unknown", and silently dropping the constraints at edges. gcc/analyzer/ChangeLog: PR analyzer/93356 * region-model.cc (region_model::eval_condition): In both overloads, bail out immediately on floating-point types. (region_model::eval_condition_without_cm): Likewise. (region_model::add_constraint): Likewise. gcc/testsuite/ChangeLog: PR analyzer/93356 * gcc.dg/analyzer/conditionals-notrans.c (test_float_selfcmp): Add. * gcc.dg/analyzer/conditionals-trans.c: Mark floating point comparison test as failing. (test_float_selfcmp): Add. * gcc.dg/analyzer/data-model-1.c: Mark floating point comparison tests as failing. * gcc.dg/analyzer/torture/pr93356.c: New test. gcc/ChangeLog: PR analyzer/93356 * doc/analyzer.texi (Limitations): Note that constraints on floating-point values are currently ignored.
2020-01-30analyzer: avoid comparisons between uncomparable types (PR 93450)David Malcolm4-15/+43
PR analyzer/93450 reports an ICE trying to fold an EQ_EXPR comparison of (int)0 with (float)Inf. Most comparisons inside the analyzer come from gimple conditions, for which the necessary casts have already been added. This one is done inside constant_svalue::eval_condition as part of purging sm-state for an unknown function call, and fails to check the types being compared, leading to the ICE. sm_state_map::set_state calls region_model::eval_condition_without_cm in order to handle pointer equality (so that e.g. (void *)&r and (foo *)&r transition together), which leads to this code generating a bogus query to see if the two constants are equal. This patch fixes the ICE in two ways: - It avoids generating comparisons within constant_svalue::eval_condition unless the types are equal (thus for constants, but not for pointer values, which are handled by region_svalue). - It updates sm_state_map::set_state to bail immediately if the new state is the same as the old one, thus avoiding the above for the common case where an svalue_id has no sm-state (such as for the int and float constants in the reproducer), for which the above becomes a no-op. gcc/analyzer/ChangeLog: PR analyzer/93450 * program-state.cc (sm_state_map::set_state): For the overload taking an svalue_id, bail out if the set_state on the ec does nothing. Convert the latter's return type from void to bool, returning true if anything changed. (sm_state_map::impl_set_state): Convert the return type from void to bool, returning true if the state changed. * program-state.h (sm_state_map::set_state): Convert return type from void to bool. (sm_state_map::impl_set_state): Likewise. * region-model.cc (constant_svalue::eval_condition): Only call fold_build2 if the types are the same. gcc/testsuite/ChangeLog: PR analyzer/93450 * gcc.dg/analyzer/torture/pr93450.c: New test.
2020-01-29analyzer: fix build with gcc 4.4 (PR 93276)Jakub Jelinek5-47/+21
All that is really needed is make sure you #include "diagnostic-core.h" before including pretty-print.h. By including diagnostic-core.h first, you do: and then pretty-print.h will do: If instead pretty-print.h is included first, then it will use __gcc_diag__ instead of __gcc_tdiag__ and thus will assume %E/%D etc. can't be handled. 2020-01-29 Jakub Jelinek <jakub@redhat.com> * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove. * constraint-manager.cc: Include diagnostic-core.h before graphviz.h. (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT. * state-purge.cc: Include diagnostic-core.h before gimple-pretty-print.h. (state_purge_annotator::add_node_annotations, print_vec_of_names): Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT. * region-model.cc: Move diagnostic-core.h include before graphviz.h. (path_var::dump, svalue::print, constant_svalue::print_details, region::dump_to_pp, region::dump_child_label, region::print_fields, map_region::print_fields, map_region::dump_dot_to_pp, map_region::dump_child_label, array_region::print_fields, array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
2020-01-28analyzer: fix ICE when longjmp isn't marked 'noreturn' (PR 93316)David Malcolm2-10/+12
Comments 11-16 within PR analyzer/93316 discuss an ICE in some setjmp tests seen on AIX and powerpc-darwin9. The issue turned out to be an implicit assumption that longjmp is marked "noreturn". There are two places in engine.cc where the code attempted to locate the longjmp GIMPLE_CALL by finding the final stmt within its supernode, in one place casting it via "as_a <gcall *>", in the other using it as the location_t of the "rewinding from longjmp..." event. When longjmp isn't marked noreturn, its basic block and hence supernode can have additional stmts after the longjmp; in the setjmp-3.c case this was a GIMPLE_RETURN, leading to a ICE when casting this to a GIMPLE_CALL. This patch fixes the two places in question to use the rewind_info_t::get_longjmp_call member function introduced by 342e14ffa30e9163a1a75e0a4fb21b6883d58dbe, fixing the ICE (and ensuring the correct location_t is used for events). gcc/analyzer/ChangeLog: PR analyzer/93316 * engine.cc (rewind_info_t::update_model): Get the longjmp call stmt via get_longjmp_call () rather than assuming it is the last stmt in the longjmp's supernode. (rewind_info_t::add_events_to_path): Get the location_t for the rewind_from_longjmp_event via get_longjmp_call () rather than from the supernode's get_end_location ().
2020-01-28diagnostic_metadata: unbreak xgettext (v2)David Malcolm7-55/+75
Changed in v2: - rename from warning_with_metadata_at to warning_meta - fix test plugins While C++ can have overloads, xgettext can't deal with overloads that have different argument positions, leading to two failures in "make gcc.pot": emit_diagnostic_valist used incompatibly as both --keyword=emit_diagnostic_valist:4 --flag=emit_diagnostic_valist:4:gcc-internal-format and --keyword=emit_diagnostic_valist:5 --flag=emit_diagnostic_valist:5:gcc-internal-format warning_at used incompatibly as both --keyword=warning_at:3 --flag=warning_at:3:gcc-internal-format and --keyword=warning_at:4 --flag=warning_at:4:gcc-internal-format The emit_diagnostic_valist overload isn't used anywhere (I think it's a leftover from an earlier iteration of the analyzer patch kit). The warning_at overload is used throughout the analyzer but nowhere else. Ideally I'd like to consolidate this argument with something constructable in various ways: - from a metadata and an int or - from an int (or, better an "enum opt_code"), so that the overload happens when implicitly choosing the ctor, but that feels like stage 1 material. In the meantime, fix xgettext by deleting the unused overload and renaming the used one. gcc/analyzer/ChangeLog: * region-model.cc (poisoned_value_diagnostic::emit): Update for renaming of warning_at overload to warning_meta. * sm-file.cc (file_leak::emit): Likewise. * sm-malloc.cc (double_free::emit): Likewise. (possible_null_deref::emit): Likewise. (possible_null_arg::emit): Likewise. (null_deref::emit): Likewise. (null_arg::emit): Likewise. (use_after_free::emit): Likewise. (malloc_leak::emit): Likewise. (free_of_non_heap::emit): Likewise. * sm-sensitive.cc (exposure_through_output_file::emit): Likewise. * sm-signal.cc (signal_unsafe_call::emit): Likewise. * sm-taint.cc (tainted_array_index::emit): Likewise. gcc/ChangeLog: * diagnostic-core.h (warning_at): Rename overload to... (warning_meta): ...this. (emit_diagnostic_valist): Delete decl of overload taking diagnostic_metadata. * diagnostic.c (emit_diagnostic_valist): Likewise for defn. (warning_at): Rename overload taking diagnostic_metadata to... (warning_meta): ...this. gcc/testsuite/ChangeLog: * gcc.dg/plugin/diagnostic_plugin_test_metadata.c: Update for renaming of warning_at overload to warning_meta. * gcc.dg/plugin/diagnostic_plugin_test_paths.c: Likewise.
2020-01-27analyzer: fix ICE when canonicalizing NaN (PR 93451)David Malcolm2-3/+100
PR analyzer/93451 reports an ICE when canonicalizing the constants in a region_model, with a failed qsort_chk when attempting to sort the constants within the region_model. The svalues in the model were: sv0: {poisoned: uninit} sv1: {type: ‘double’, ‘0.0’} sv2: {type: ‘double’, ‘1.0e+0’} sv3: {type: ‘double’, ‘ Nan’} The qsort_chk of the 3 constants fails due to tree_cmp using the LT_EXPR ordering of the REAL_CSTs, which doesn't work for NaN. This patch adjusts tree_cmp to impose an arbitrary ordering during canonicalization for UNORDERED_EXPR cases w/o relying on the LT_EXPR ordering, fixing the ICE. gcc/analyzer/ChangeLog: PR analyzer/93451 * region-model.cc (tree_cmp): For the REAL_CST case, impose an arbitrary order on NaNs relative to other NaNs and to non-NaNs; const-correctness tweak. (ana::selftests::build_real_cst_from_string): New function. (ana::selftests::append_interesting_constants): New function. (ana::selftests::test_tree_cmp_on_constants): New test. (ana::selftests::test_canonicalization_4): New test. (ana::selftests::analyzer_region_model_cc_tests): Call the new tests. gcc/testsuite/ChangeLog: PR analyzer/93451 * gcc.dg/analyzer/torture/pr93451.c: New test.
2020-01-27analyzer: restore input_location (PR 93349)David Malcolm2-0/+13
PR analyzer/93349 reports an ICE in IPA pass: simdclone for some input files when -fanalyzer is supplied, with: error: location references block not in block tree The root cause is that the analyzer touches input_location in some places (to make it easier to track down which source construct the analyzer can't handle in the case of an analyzer ICE) and fails to reset it. For the ICE in question, this sets input_location to a location_t that references some arbitrary block (specifically, that of the last statement to be analyzed, within the original CFG of whichever is the last such function to be analyzed). Later, within omp-simd-clone.c, input_location is used by gimplify_expr (called via gimplify_and_add), which has: 14492 if (!gimple_seq_empty_p (*pre_p)) 14493 annotate_all_with_location_after (*pre_p, pre_last_gsi, input_location); thus using whatever the value of input_location is, leading to statements that reference some arbitrary block in the original CFG. For the reproducer, this happens to be a block in the CFG for the original function, rather than that of the clone, but in general it could be some arbitrary other function in the TU. This code appears to assume that input_location has some arbitrary value *not* in the block tree, which is potentially violated by the analyzer's changes to input_location. This patch adds a save and restore of input_location at the top-level function of the analyzer, fixing the ICE. gcc/analyzer/ChangeLog: PR analyzer/93349 * engine.cc (run_checkers): Save and restore input_location. gcc/testsuite/ChangeLog: PR analyzer/93349 * gcc.dg/analyzer/torture/pr93349.c: New test.
2020-01-27analyzer: fixes to tree_cmp and other comparatorsDavid Malcolm6-69/+21
region_model.cc's tree_cmp attempted to verify that the ordering is symmetric by asserting that tree_cmp (x, y) == -tree_cmp (y, x) This condition is too strong: it's only required for a comparator that sign (tree_cmp (x, y)) == -sign (tree_cmp (y, x)) and the incorrect form of the assertion doesn't hold e.g. on s390x where for certain inputs x, y, tree_cmp (x, y) == 1 and tree_cmp (y, x) == -2, breaking the build in "make selftest" in stage1. In any case, these checks are redundant, since qsort_chk performs them. Additionally, there is a potential lack of transitivity in worklist::key_t::cmp where hashval_t values are compared by subtraction, which could fail to be transitive if overflows occur. This patch eliminates the redundant checks and reimplements the hashval_t comparisons in terms of < and >, fixing these issues. gcc/analyzer/ChangeLog: * call-string.cc (call_string::cmp_1): Delete, moving body to... (call_string::cmp): ...here. * call-string.h (call_string::cmp_1): Delete decl. * engine.cc (worklist::key_t::cmp_1): Delete, moving body to... (worklist::key_t::cmp): ...here. Implement hash comparisons via comparison rather than subtraction to avoid overflow issues. * exploded-graph.h (worklist::key_t::cmp_1): Delete decl. * region-model.cc (tree_cmp): Eliminate buggy checking for symmetry.
2020-01-27analyzer: fix setjmp-detection and support sigsetjmpDavid Malcolm10-55/+183
This patch removes the hack in is_setjmp_call_p of looking for "setjmp" and "_setjmp", replacing it with some logic adapted from special_function_p in calls.c, ignoring up to 2 leading underscores from the fndecl's name when checking for a function by name. It also requires that such functions are "extern" and at file scope for them to be matched. The patch also generalizes the setjmp/longjmp handling in the analyzer to also work with sigsetjmp/siglongjmp. Doing so requires generalizing some hardcoded functions in diagnostics (which were hardcoded to avoid user-facing messages referring to "_setjmp", which is an implementation detail) - the patch adds a new function, get_user_facing_name for this, for use on calls that matched is_named_call_p and is_specical_named_call_p. gcc/analyzer/ChangeLog: * analyzer.cc (is_named_call_p): Check that fndecl is "extern" and at file scope. Potentially disregard prefix _ or __ in fndecl's name. Bail if the identifier is NULL. (is_setjmp_call_p): Expect a gcall rather than plain gimple. Remove special-case check for leading prefix, and also check for sigsetjmp. (is_longjmp_call_p): Also check for siglongjmp. (get_user_facing_name): New function. * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain gimple. (get_user_facing_name): New decl. * checker-path.cc (setjmp_event::get_desc): Use get_user_facing_name to avoid hardcoding the function name. (rewind_event::rewind_event): Add rewind_info param, using it to initialize new m_rewind_info field, and strengthen the assertion. (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to avoid hardcoding the function name. (rewind_to_setjmp_event::get_desc): Likewise. * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call param and use it to initialize... (setjmp_event::m_setjmp_call): New field. (rewind_event::rewind_event): Add rewind_info param. (rewind_event::m_rewind_info): New protected field. (rewind_from_longjmp_event::rewind_from_longjmp_event): Add rewind_info param. (class rewind_to_setjmp_event): Move rewind_info field to parent class. * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge): Update setjmp-handling for is_setjmp_call_p requiring a gcall; pass the call to the new setjmp_event. * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p requiring a gcall. (stale_jmp_buf::emit): Use get_user_facing_name to avoid hardcoding the function names. (exploded_node::on_longjmp): Pass the longjmp_call when constructing rewind_info. (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the rewind_from_longjmp_event's ctor. * exploded-graph.h (rewind_info_t::rewind_info_t): Add longjmp_call param. (rewind_info_t::get_longjmp_call): New. (rewind_info_t::m_longjmp_call): New. * region-model.cc (region_model::on_setjmp): Update comment to indicate this is also for sigsetjmp. * region-model.h (struct setjmp_record): Likewise. (class setjmp_svalue): Likewise. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/sigsetjmp-5.c: New test. * gcc.dg/analyzer/sigsetjmp-6.c: New test.
2020-01-27analyzer: fix build with gcc 4.4 (PR 93276)David Malcolm6-21/+49
This patch fixes various build failures seen with gcc 4.4 gcc prior to 4.6 complains about: error: #pragma GCC diagnostic not allowed inside functions for various uses of PUSH_IGNORE_WFORMAT and POP_IGNORE_WFORMAT. This patch makes them a no-op with such compilers. The patch also fixes various errors with template base initializers and redundant uses of "typename" that older g++ implementations can't cope with. gcc/analyzer/ChangeLog: PR analyzer/93276 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these macros with GCC_VERSION >= 4006, making them no-op otherwise. * engine.cc (exploded_edge::exploded_edge): Specify template for base class initializer. (exploded_graph::add_edge): Specify template when chaining up to base class add_edge implementation. (viz_callgraph_node::dump_dot): Drop redundant "typename". (viz_callgraph_edge::viz_callgraph_edge): Specify template for base class initializer. * program-state.cc (sm_state_map::clone_with_remapping): Drop redundant "typename". (sm_state_map::print): Likewise. (sm_state_map::hash): Likewise. (sm_state_map::operator==): Likewise. (sm_state_map::remap_svalue_ids): Likewise. (sm_state_map::on_svalue_purge): Likewise. (sm_state_map::validate): Likewise. * program-state.h (sm_state_map::iterator_t): Likewise. * supergraph.h (superedge::superedge): Specify template for base class initializer. gcc/ChangeLog: PR analyzer/93276 * digraph.cc (test_edge::test_edge): Specify template for base class initializer.
2020-01-23analyzer: avoid ICE with missing arguments (PR 93375)David Malcolm2-4/+18
PR analyzer/93375 reports an ICE under certain circumstances involving a call where the number of arguments at the callsite is less than the parameter count of the callee, Specifically, the ICE occurs when pruning a checker_path for a diagnostic, when attempting to maintain which expression is of interest through such a call. The root cause is an assumption that there were enough arguments at the callsite, within callgraph_superedge's methods for mapping expressions between callee and caller. This patch adds checks for this to the relevant methods, fixing the ICE. gcc/analyzer/ChangeLog: PR analyzer/93375 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail gracefully is the number of parameters at the callee exceeds the number of arguments at the call stmt. (callgraph_superedge::get_parm_for_arg): Likewise. gcc/testsuite/ChangeLog: PR analyzer/93375 * gcc.dg/analyzer/pr93375.c: New test.
2020-01-22analyzer: fix ICE due to sm-state origin being purged (PR 93382)David Malcolm2-0/+12
The ICE in PR analyzer/93382 is a validation error. The global variable "idx" acquires a "tainted" state from local array n1[0]. When the frame is popped, the svalue for n1[0] is purged, but the "taint" sm_state_map's entry for "idx" has a svalue_id referencing the now-purged svalue. This is caught by program_state::validate as an assertion failure. This patch fixes the issue by resetting the origin id within sm_state_map entries for the case where the origin id has been purged. gcc/analyzer/ChangeLog: PR analyzer/93382 * program-state.cc (sm_state_map::on_svalue_purge): If the entry survives, but the origin is being purged, then reset the origin to null. gcc/testsuite/ChangeLog: PR analyzer/93382 * gcc.dg/analyzer/pr93382.c: New test.
2020-01-22analyzer: fix build with --enable-checking=releaseDavid Malcolm2-1/+6
When adding namespaces to the analyzer in r10-6151-g75038aa6aa5b562e6358108619d66ef2ccab9a53 I messed up the nesting of the #endif for #if CHECKING_P and the closing of namespace ana. This patch fixes it. gcc/analyzer/ChangeLog: * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
2020-01-22analyzer: fix setjmp handling with -g (PR 93378)David Malcolm5-24/+80
PR analyzer/93378 reports an ICE at -O1 -g when analyzing a rewind via longjmp to a setjmp call with. The root cause is that the rewind_info_t::get_setjmp_call attempts to locate the setjmp GIMPLE_CALL via within the exploded_node containing it, but the exploded_node has two stmts: a GIMPLE_DEBUG, then the GIMPLE_CALL, and so erroneously picks the GIMPLE_DEBUG, leading to a failed as_a <const gcall *>. This patch reworks how the analyzer stores information about a setjmp so that instead of storing an exploded_node *, it instead introduces a "setjmp_record" struct, for use by both setjmp_svalue and rewind_info_t. Hence we store the information directly, rather than attempting to reconstruct it, fixing the bug. gcc/analyzer/ChangeLog: PR analyzer/93378 * engine.cc (setjmp_svalue::compare_fields): Update for replacement of m_enode with m_setjmp_record. (setjmp_svalue::add_to_hash): Likewise. (setjmp_svalue::get_index): Rename... (setjmp_svalue::get_enode_index): ...to this. (setjmp_svalue::print_details): Update for replacement of m_enode with m_setjmp_record. (exploded_node::on_longjmp): Likewise. * exploded-graph.h (rewind_info_t::m_enode_origin): Replace... (rewind_info_t::m_setjmp_record): ...with this. (rewind_info_t::rewind_info_t): Update for replacement of m_enode with m_setjmp_record. (rewind_info_t::get_setjmp_point): Likewise. (rewind_info_t::get_setjmp_call): Likewise. * region-model.cc (region_model::dump_summary_of_map): Likewise. (region_model::on_setjmp): Likewise. * region-model.h (struct setjmp_record): New struct. (setjmp_svalue::m_enode): Replace... (setjmp_svalue::m_setjmp_record): ...with this. (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode with m_setjmp_record. (setjmp_svalue::clone): Likewise. (setjmp_svalue::get_index): Rename... (setjmp_svalue::get_enode_index): ...to this. (setjmp_svalue::get_exploded_node): Replace... (setjmp_svalue::get_setjmp_record): ...with this. gcc/testsuite/ChangeLog: PR analyzer/93378 * gcc.dg/analyzer/setjmp-pr93378.c: New test.
2020-01-22analyzer: testsuite fixes for alloca, getpass, and setjmp (PR 93316)David Malcolm2-1/+8
PR analyzer/93316 reports various testsuite failures where I accidentally relied on properties of x86_64-pc-linux-gnu. The following patch fixes them on sparc-sun-solaris2.11 (gcc211 in the GCC compile farm), and, I hope, the other configurations showing failures. There may still be other failures for pattern-test-2.c, which I'm tracking separately as PR analyzer/93291. gcc/analyzer/ChangeLog: PR analyzer/93316 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as "_setjmp". gcc/testsuite/ChangeLog: PR analyzer/93316 * gcc.dg/analyzer/data-model-1.c: Include <alloca.h>. * gcc.dg/analyzer/malloc-1.c: Likewise. * gcc.dg/analyzer/malloc-callbacks.c (get_alloca): Return __builtin_alloca rather than alloca. * gcc.dg/analyzer/malloc-paths-8.c: Include <alloca.h>. * gcc.dg/analyzer/sensitive-1.c: Define __EXTENSIONS__ before including unistd.h. * gcc.dg/analyzer/setjmp-2.c: Replace include of <setjmp.h> with "test-setjmp.h" and usage of setjmp with new SETJMP macro. * gcc.dg/analyzer/setjmp-3.c: Likewise. * gcc.dg/analyzer/setjmp-4.c: Likewise. * gcc.dg/analyzer/setjmp-5.c: Likewise. * gcc.dg/analyzer/setjmp-6.c: Likewise. * gcc.dg/analyzer/setjmp-7.c: Likewise. * gcc.dg/analyzer/setjmp-7a.c: Likewise. * gcc.dg/analyzer/setjmp-8.c: Likewise. * gcc.dg/analyzer/setjmp-9.c: Likewise. * gcc.dg/analyzer/test-setjmp.h: New header.
2020-01-22analyzer: introduce namespace to avoid ODR clashes (PR 93307)David Malcolm39-2/+308
PR analyzer/93307 reports that in an LTO bootstrap, there are ODR violations between: - the "region" type: gcc/analyzer/region-model.h:792 vs: gcc/sched-int.h:1443 - the "constraint" type: gcc/analyzer/constraint-manager.h:121 vs: gcc/tree-ssa-structalias.c:533 This patches solves this clash by putting all of the analyzer names within a namespace. I chose "ana" as it is short (to save typing). The analyzer selftests are moved from namespace "selftest" to "ana::selftest". There are various places where the namespace has to be closed and reopened, to allow e.g. for specializations of templates in the global namespace. gcc/analyzer/ChangeLog: PR analyzer/93307 * analysis-plan.h: Wrap everything namespace "ana". * analyzer-logging.cc: Likewise. * analyzer-logging.h: Likewise. * analyzer-pass.cc (pass_analyzer::execute): Update for "ana" namespace. * analyzer-selftests.cc: Wrap everything namespace "ana". * analyzer-selftests.h: Likewise. * analyzer.h: Likewise for forward decls of types. * call-string.h: Likewise. * checker-path.cc: Likewise. * checker-path.h: Likewise. * constraint-manager.cc: Likewise. * constraint-manager.h: Likewise. * diagnostic-manager.cc: Likewise. * diagnostic-manager.h: Likewise. * engine.cc: Likewise. * engine.h: Likewise. * exploded-graph.h: Likewise. * function-set.cc: Likewise. * function-set.h: Likewise. * pending-diagnostic.cc: Likewise. * pending-diagnostic.h: Likewise. * program-point.cc: Likewise. * program-point.h: Likewise. * program-state.cc: Likewise. * program-state.h: Likewise. * region-model.cc: Likewise. * region-model.h: Likewise. * sm-file.cc: Likewise. * sm-malloc.cc: Likewise. * sm-pattern-test.cc: Likewise. * sm-sensitive.cc: Likewise. * sm-signal.cc: Likewise. * sm-taint.cc: Likewise. * sm.cc: Likewise. * sm.h: Likewise. * state-purge.h: Likewise. * supergraph.cc: Likewise. * supergraph.h: Likewise. gcc/ChangeLog: PR analyzer/93307 * gdbinit.in (break-on-saved-diagnostic): Update for move of diagnostic_manager into "ana" namespace. * selftest-run-tests.c (selftest::run_tests): Update for move of selftest::run_analyzer_selftests to ana::selftest::run_analyzer_selftests.
2020-01-21analyzer: fix qsort issue with array_region keys (PR 93352)David Malcolm3-7/+25
PR analyzer/93352 reports a qsort failure "comparator not anti-symmetric: -2147483648, -2147483648)" within the analyzer on code involving an array access of [0x7fffffff + 1]. The issue is that array_region (which uses int for keys into known values in the array) uses subtraction to implement int_cmp for sorting the keys, which isn't going to work for boundary values. Potentially a wider type should be used, but for now this patch fixes the ICE by using explicit comparisons rather than subtraction to implement the qsort callback. gcc/analyzer/ChangeLog: PR analyzer/93352 * region-model.cc (int_cmp): Rename to... (array_region::key_cmp): ...this, using key_t rather than int. Rewrite in terms of comparisons rather than subtraction to ensure qsort is anti-symmetric when handling extreme values. (array_region::walk_for_canonicalization): Update for above renaming. * region-model.h (array_region::key_cmp): New decl. gcc/testsuite/ChangeLog: PR analyzer/93352 * gcc.dg/analyzer/pr93352.c: New test.
2020-01-17analyzer: prevent ICE on isnan (PR 93290)David Malcolm2-4/+13
PR analyzer/93290 reports an ICE on calls to isnan(). The root cause is that an UNORDERED_EXPR is passed to region_model::eval_condition_without_cm, and there's a stray gcc_unreachable () in the case where we're comparing an svalue against itself. I attempted a more involved patch that properly handled NaN in general but it seems I've baked the assumption of reflexivity too deeply into the constraint_manager code. For now, this patch avoids the ICE and documents the limitation. gcc/analyzer/ChangeLog: PR analyzer/93290 * region-model.cc (region_model::eval_condition_without_cm): Avoid gcc_unreachable for unexpected operations for the case where we're comparing an svalue against itself. gcc/ChangeLog * doc/analyzer.texi (Limitations): Add note about NaN. gcc/testsuite/ChangeLog: PR analyzer/93290 * gcc.dg/analyzer/pr93290.c: New test.
2020-01-17analyzer: fix handling of negative byte offsets (v2) (PR 93281)David Malcolm2-4/+15
Various 32-bit targets show failures in gcc.dg/analyzer/data-model-1.c with tests of the form: __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */ __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */ where they emit UNKNOWN instead. The root cause is that gimple has a byte-based twos-complement offset of -16 expressed like this: _55 = q_92 + 4294967280; (32-bit) or: _55 = q_92 + 18446744073709551600; (64-bit) Within region_model::convert_byte_offset_to_array_index that unsigned offset was being divided by the element size to get an offset within an array. This happened to work on 64-bit target and host, but not elsewhere; the offset needs to be converted to a signed type before the division is meaningful. This patch does so, fixing the failures. gcc/analyzer/ChangeLog: PR analyzer/93281 * region-model.cc (region_model::convert_byte_offset_to_array_index): Convert to ssizetype before dividing by byte_size. Use fold_binary rather than fold_build2 to avoid needlessly constructing a tree for the non-const case.
2020-01-15analyzer: fix commentDavid Malcolm2-1/+5
I rewrote class impl_region_model_context to avoid using multiple inheritance during patch review but forgot to update this comment. Fix it. gcc/analyzer/ChangeLog: * engine.cc (class impl_region_model_context): Fix comment.
2020-01-14analyzer: fix ICE on METHOD_TYPE (PR 93212)David Malcolm3-2/+9
PR analyzer/93212 reports an ICE when attempting to use -fanalyzer on a C++ source file. That isn't supported yet, but the fix is trivial (handling METHOD_TYPE as well as FUNCTION_TYPE). gcc/analyzer/ChangeLog: PR analyzer/93212 * region-model.cc (make_region_for_type): Use FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE. * region-model.h (function_region::function_region): Likewise.
2020-01-14analyzer: fix global-sm-state issue affecting sm-signalDavid Malcolm2-0/+42
sm-signal.cc was failing to warn about the use of an fprintf call in a signal handler when the signal handler function was non-static. The root cause was a failure to copy global sm-state within sm_state_map::clone_with_remapping as called by program_state::can_merge_with_p, which led to the exploded node for the entrypoint to the handler in the "normal" state being erroneously reused for the "in_signal_handler" state, thus losing the global state, and thus failing to warn. This patch fixes the above, so that non-equal global sm-state values prevent merger of program_state, thus requiring separate exploded nodes for the "normal" and "in signal handler" states, and thus triggering the warning for the reproducer. gcc/analyzer/ChangeLog: * program-state.cc (sm_state_map::clone_with_remapping): Copy m_global_state. (selftest::test_program_state_merging_2): New selftest. (selftest::analyzer_program_state_cc_tests): Call it. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/signal-6.c: New test.
2020-01-14analyzer: cleanups to checker_pathDavid Malcolm3-17/+40
This patch adds DISABLE_COPY_AND_ASSIGN to checker_path, and makes its fields private. gcc/analyzer/ChangeLog: * checker-path.h (checker_path::get_checker_event): New function. (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private. * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic): Replace direct access to checker_path::m_events with accessor functions. Fix overlong line. (diagnostic_manager::prune_interproc_events): Replace direct access to checker_path::m_events with accessor functions. (diagnostic_manager::finish_pruning): Likewise.
2020-01-14analyzer: delete checker_event::cloneDavid Malcolm2-72/+17
checker_event has a clone vfunc implemented by all the concrete subclasses, but this is never used (a holdover from a very early implementation). This patch deletes it. gcc/analyzer/ChangeLog: * checker-path.h (checker_event::clone): Delete vfunc decl. (debug_event::clone): Delete vfunc impl. (custom_event::clone): Delete vfunc impl. (statement_event::clone): Delete vfunc impl. (function_entry_event::clone): Delete vfunc impl. (state_change_event::clone): Delete vfunc impl. (start_cfg_edge_event::clone): Delete vfunc impl. (end_cfg_edge_event::clone): Delete vfunc impl. (call_event::clone): Delete vfunc impl. (return_event::clone): Delete vfunc impl. (setjmp_event::clone): Delete vfunc impl. (rewind_from_longjmp_event::clone): Delete vfunc impl. (rewind_to_setjmp_event::clone): Delete vfunc impl. (warning_event::clone): Delete vfunc impl.
2020-01-14analyzer: ensure .dot output is valid for an empty BBDavid Malcolm2-0/+21
This patch fixes an issue with the output of -fdump-analyzer-supergraph on BBs with no statements, where the resulting files were unreadable by dot e.g.: Error: syntax error in line 1 ... <TABLE BORDER="0"></TABLE> ... in label of node node_10 gcc/analyzer/ChangeLog: * supergraph.cc (supernode::dump_dot): Ensure that the TABLE element has at least one TR. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/dot-output.c: Add test coverage for a BB with no statements.
2020-01-14analyzer: fix tests for UNKNOWN_LOCATIONDavid Malcolm3-8/+20
In the reproducer for PR analyzer/58237 I noticed that some events were missing locations (and text); for example event 3 here: | 15 | while (fgets(buf, 10, fp) != NULL) | | ~ | | | | | (2) following 'false' branch... | 'f1': event 3 | |cc1: | 'f1': event 4 | |<source>:19:1: | 19 | } | | ^ | | | | | (4) 'fp' leaks here; was opened at (1) | The root cause is that various places in the analyzer compare locations against UNKNOWN_LOCATION, which fails to detect an unknown location for the case where an unknown_location has been wrapped into an ad-hoc location to record a block. This patch fixes the issue by using get_pure_location whenever testing against UNKNOWN_LOCATION to look through ad-hoc wrappers. For the case above, it thus picks a better location in supernode::get_start_location for event (3) above, improving it to: | 15 | while (fgets(buf, 10, fp) != NULL) | | ~ | | | | | (2) following 'false' branch... |...... | 19 | } | | ~ | | | | | (3) ...to here | | (4) 'fp' leaks here; was opened at (1) | gcc/analyzer/ChangeLog: PR analyzer/58237 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location when comparing against UNKNOWN_LOCATION. (stmt_requires_new_enode_p): Likewise. (exploded_graph::dump_exploded_nodes): Likewise. * supergraph.cc (supernode::get_start_location): Likewise. (supernode::get_end_location): Likewise. gcc/testsuite/ChangeLog: PR analyzer/58237 * gcc.dg/analyzer/file-paths-1.c: New test.
2020-01-14analyzer: add known stdio functions to sm-file.cc (PR analyzer/58237)David Malcolm4-3/+117
The analyzer ought to report various file leaks for the reproducer in PR analyzer/58237, such as: void f1(const char *str) { FILE * fp = fopen(str, "r"); char buf[10]; while (fgets(buf, 10, fp) != NULL) { /* Do something with buf */ } /* Missing call to fclose. Need warning here for resource leak */ } but fails to do so, due to not recognizing fgets, and thus conservatively assuming that it could close "fp". This patch adds a function_set to sm-file.cc of numerous stdio.h functions that are known to not close the file (and which require a valid FILE *, but that's a matter for a followup), fixing the issue. gcc/analyzer/ChangeLog: PR analyzer/58237 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call selftest::analyzer_sm_file_cc_tests. * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New decl. * sm-file.cc: Include "analyzer/function-set.h" and "analyzer/analyzer-selftests.h". (get_file_using_fns): New function. (is_file_using_fn_p): New function. (fileptr_state_machine::on_stmt): Return true for known functions. (selftest::analyzer_sm_file_cc_tests): New function. gcc/testsuite/ChangeLog: PR analyzer/58237 * gcc.dg/analyzer/file-1.c (test_4): New. * gcc.dg/analyzer/file-pr58237.c: New test.
2020-01-14analyzer: introduce a set of known async-signal-unsafe functionsDavid Malcolm4-7/+64
This patch uses the class function_set from the previous patch to generalize the test for an fprintf inside a signal handler to check for a set of known async-signal-unsafe functions. gcc/analyzer/ChangeLog: * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call selftest::analyzer_sm_signal_cc_tests. * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests): New decl. * sm-signal.cc: Include "analyzer/function-set.h" and "analyzer/analyzer-selftests.h". (get_async_signal_unsafe_fns): New function. (signal_unsafe_p): Reimplement in terms of the above. (selftest::analyzer_sm_signal_cc_tests): New function. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/signal-5.c: New test.
2020-01-14analyzer: add function-set.cc/hDavid Malcolm5-0/+248
This patch adds a simple mechanism for tracking sets of functions for which a particular property holds, as a pragmatic way to build knowledge about important APIs into the analyzer without requiring markup of the user's libc. gcc/ChangeLog: * Makefile.in (ANALYZER_OBJS): Add analyzer/function-set.o. gcc/analyzer/ChangeLog: * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call selftest::analyzer_function_set_cc_tests. * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests): New decl. * function-set.cc: New file. * function-set.h: New file.
2020-01-14analyzer: purge state for unknown function callsDavid Malcolm8-18/+283
Whilst analyzing the reproducer for detecting CVE-2005-1689 (krb5-1.4.1's src/lib/krb5/krb/recvauth.c), the analyzer reports a false double-free of the form: krb5_xfree(inbuf.data); krb5_read_message(..., &inbuf); krb5_xfree(inbuf.data); /* false diagnostic here. */ where the call to krb5_read_message overwrites inbuf.data with a freshly-malloced buffer. This patch fixes the issue by purging state more thorougly when handling a call with unknown behavior, by walking the graph of memory regions that are reachable from the call. gcc/analyzer/ChangeLog: * analyzer.h (fndecl_has_gimple_body_p): New decl. * engine.cc (impl_region_model_context::on_unknown_change): New function. (fndecl_has_gimple_body_p): Make non-static. (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as known. Track whether we have a call with unknown side-effects and pass it to on_call_post. * exploded-graph.h (impl_region_model_context::on_unknown_change): New decl. * program-state.cc (sm_state_map::on_unknown_change): New function. * program-state.h (sm_state_map::on_unknown_change): New decl. * region-model.cc: Include "bitmap.h". (region_model::on_call_pre): Return a bool, capturing whether the call has unknown side effects. (region_model::on_call_post): Add arg "bool unknown_side_effects" and if true, call handle_unrecognized_call. (class reachable_regions): New class. (region_model::handle_unrecognized_call): New function. * region-model.h (region_model::on_call_pre): Return a bool. (region_model::on_call_post): Add arg "bool unknown_side_effects". (region_model::handle_unrecognized_call): New decl. (region_model_context::on_unknown_change): New vfunc. (test_region_model_context::on_unknown_change): New function. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/data-model-1.c: Remove xfail. * gcc.dg/analyzer/data-model-5b.c: Likewise. * gcc.dg/analyzer/data-model-5c.c: Likewise. * gcc.dg/analyzer/setjmp-3.c: Mark "foo" as pure. * gcc.dg/analyzer/setjmp-4.c: Likewise. * gcc.dg/analyzer/setjmp-6.c: Likewise. * gcc.dg/analyzer/setjmp-7.c: Likewise. * gcc.dg/analyzer/setjmp-7a.c: Likewise. * gcc.dg/analyzer/setjmp-8.c: Likewise. * gcc.dg/analyzer/setjmp-9.c: Likewise. * gcc.dg/analyzer/unknown-fns.c: New test.
2020-01-14analyzer: fix dedupe issue seen with CVE-2005-1689David Malcolm10-21/+57
Whilst analyzing the reproducer for detecting CVE-2005-1689 (krb5-1.4.1's src/lib/krb5/krb/recvauth.c), the analyzer reported 11 double-free diagnostics on lines of the form: krb5_xfree(inbuf.data); with no deduplication occcurring. The root cause is that the diagnostics each have a COMPONENT_REF for the inbuf.data, but they are different trees, and the de-duplication logic was using pointer equality. This patch replaces the pointer equality tests with calls to a new pending_diagnostic::same_tree_p, implemented using simple_cst_equal. With this patch, de-duplication occurs, and only 3 diagnostics are reported. The 11 diagnostics are partitioned into 3 dedupe keys, 2 with 2 duplicates and 1 with 7 duplicates. gcc/analyzer/ChangeLog: * diagnostic-manager.cc (saved_diagnostic::operator==): Move here from header. Replace pointer equality test on m_var with call to pending_diagnostic::same_tree_p. * diagnostic-manager.h (saved_diagnostic::operator==): Move to diagnostic-manager.cc. * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New. * pending-diagnostic.h (pending_diagnostic::same_tree_p): New. * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer equality on m_arg with call to pending_diagnostic::same_tree_p. * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise. (possible_null_arg::subclass_equal_p): Likewise. (null_arg::subclass_equal_p): Likewise. (free_of_non_heap::subclass_equal_p): Likewise. * sm-pattern-test.cc (pattern_match::operator==): Likewise. * sm-sensitive.cc (exposure_through_output_file::operator==): Likewise. * sm-taint.cc (tainted_array_index::operator==): Likewise. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/CVE-2005-1689-dedupe-issue.c: New test.
2020-01-14analyzer: better logging for dedupe_winners::addDavid Malcolm2-3/+25
gcc/analyzer/ChangeLog: * diagnostic-manager.cc (dedupe_winners::add): Add logging of deduplication decisions made.
2020-01-14Initial commit of analyzerDavid Malcolm43-0/+29145
This patch adds a static analysis pass to the middle-end, focusing for this release on C code, and malloc/free issues in particular. See: https://gcc.gnu.org/wiki/DavidMalcolm/StaticAnalyzer gcc/ChangeLog: * Makefile.in (lang_opt_files): Add analyzer.opt. (ANALYZER_OBJS): New. (OBJS): Add digraph.o, graphviz.o, ordered-hash-map-tests.o, tristate.o and ANALYZER_OBJS. (TEXI_GCCINT_FILES): Add analyzer.texi. * common.opt (-fanalyzer): New driver option. * config.in: Regenerate. * configure: Regenerate. * configure.ac (--disable-analyzer, ENABLE_ANALYZER): New option. (gccdepdir): Also create depdir for "analyzer" subdir. * digraph.cc: New file. * digraph.h: New file. * doc/analyzer.texi: New file. * doc/gccint.texi ("Static Analyzer") New menu item. (analyzer.texi): Include it. * doc/invoke.texi ("Static Analyzer Options"): New list and new section. ("Warning Options"): Add static analysis warnings to the list. (-Wno-analyzer-double-fclose): New option. (-Wno-analyzer-double-free): New option. (-Wno-analyzer-exposure-through-output-file): New option. (-Wno-analyzer-file-leak): New option. (-Wno-analyzer-free-of-non-heap): New option. (-Wno-analyzer-malloc-leak): New option. (-Wno-analyzer-possible-null-argument): New option. (-Wno-analyzer-possible-null-dereference): New option. (-Wno-analyzer-null-argument): New option. (-Wno-analyzer-null-dereference): New option. (-Wno-analyzer-stale-setjmp-buffer): New option. (-Wno-analyzer-tainted-array-index): New option. (-Wno-analyzer-use-after-free): New option. (-Wno-analyzer-use-of-pointer-in-stale-stack-frame): New option. (-Wno-analyzer-use-of-uninitialized-value): New option. (-Wanalyzer-too-complex): New option. (-fanalyzer-call-summaries): New warning. (-fanalyzer-checker=): New warning. (-fanalyzer-fine-grained): New warning. (-fno-analyzer-state-merge): New warning. (-fno-analyzer-state-purge): New warning. (-fanalyzer-transitivity): New warning. (-fanalyzer-verbose-edges): New warning. (-fanalyzer-verbose-state-changes): New warning. (-fanalyzer-verbosity=): New warning. (-fdump-analyzer): New warning. (-fdump-analyzer-callgraph): New warning. (-fdump-analyzer-exploded-graph): New warning. (-fdump-analyzer-exploded-nodes): New warning. (-fdump-analyzer-exploded-nodes-2): New warning. (-fdump-analyzer-exploded-nodes-3): New warning. (-fdump-analyzer-supergraph): New warning. * doc/sourcebuild.texi (dg-require-dot): New. (dg-check-dot): New. * gdbinit.in (break-on-saved-diagnostic): New command. * graphviz.cc: New file. * graphviz.h: New file. * ordered-hash-map-tests.cc: New file. * ordered-hash-map.h: New file. * passes.def (pass_analyzer): Add before pass_ipa_whole_program_visibility. * selftest-run-tests.c (selftest::run_tests): Call selftest::ordered_hash_map_tests_cc_tests. * selftest.h (selftest::ordered_hash_map_tests_cc_tests): New decl. * shortest-paths.h: New file. * timevar.def (TV_ANALYZER): New timevar. (TV_ANALYZER_SUPERGRAPH): Likewise. (TV_ANALYZER_STATE_PURGE): Likewise. (TV_ANALYZER_PLAN): Likewise. (TV_ANALYZER_SCC): Likewise. (TV_ANALYZER_WORKLIST): Likewise. (TV_ANALYZER_DUMP): Likewise. (TV_ANALYZER_DIAGNOSTICS): Likewise. (TV_ANALYZER_SHORTEST_PATHS): Likewise. * tree-pass.h (make_pass_analyzer): New decl. * tristate.cc: New file. * tristate.h: New file. gcc/analyzer/ChangeLog: * ChangeLog: New file. * analyzer-selftests.cc: New file. * analyzer-selftests.h: New file. * analyzer.opt: New file. * analysis-plan.cc: New file. * analysis-plan.h: New file. * analyzer-logging.cc: New file. * analyzer-logging.h: New file. * analyzer-pass.cc: New file. * analyzer.cc: New file. * analyzer.h: New file. * call-string.cc: New file. * call-string.h: New file. * checker-path.cc: New file. * checker-path.h: New file. * constraint-manager.cc: New file. * constraint-manager.h: New file. * diagnostic-manager.cc: New file. * diagnostic-manager.h: New file. * engine.cc: New file. * engine.h: New file. * exploded-graph.h: New file. * pending-diagnostic.cc: New file. * pending-diagnostic.h: New file. * program-point.cc: New file. * program-point.h: New file. * program-state.cc: New file. * program-state.h: New file. * region-model.cc: New file. * region-model.h: New file. * sm-file.cc: New file. * sm-malloc.cc: New file. * sm-malloc.dot: New file. * sm-pattern-test.cc: New file. * sm-sensitive.cc: New file. * sm-signal.cc: New file. * sm-taint.cc: New file. * sm.cc: New file. * sm.h: New file. * state-purge.cc: New file. * state-purge.h: New file. * supergraph.cc: New file. * supergraph.h: New file. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/CVE-2005-1689-minimal.c: New test. * gcc.dg/analyzer/abort.c: New test. * gcc.dg/analyzer/alloca-leak.c: New test. * gcc.dg/analyzer/analyzer-decls.h: New header. * gcc.dg/analyzer/analyzer-verbosity-0.c: New test. * gcc.dg/analyzer/analyzer-verbosity-1.c: New test. * gcc.dg/analyzer/analyzer-verbosity-2.c: New test. * gcc.dg/analyzer/analyzer.exp: New suite. * gcc.dg/analyzer/attribute-nonnull.c: New test. * gcc.dg/analyzer/call-summaries-1.c: New test. * gcc.dg/analyzer/conditionals-2.c: New test. * gcc.dg/analyzer/conditionals-3.c: New test. * gcc.dg/analyzer/conditionals-notrans.c: New test. * gcc.dg/analyzer/conditionals-trans.c: New test. * gcc.dg/analyzer/data-model-1.c: New test. * gcc.dg/analyzer/data-model-2.c: New test. * gcc.dg/analyzer/data-model-3.c: New test. * gcc.dg/analyzer/data-model-4.c: New test. * gcc.dg/analyzer/data-model-5.c: New test. * gcc.dg/analyzer/data-model-5b.c: New test. * gcc.dg/analyzer/data-model-5c.c: New test. * gcc.dg/analyzer/data-model-5d.c: New test. * gcc.dg/analyzer/data-model-6.c: New test. * gcc.dg/analyzer/data-model-7.c: New test. * gcc.dg/analyzer/data-model-8.c: New test. * gcc.dg/analyzer/data-model-9.c: New test. * gcc.dg/analyzer/data-model-11.c: New test. * gcc.dg/analyzer/data-model-12.c: New test. * gcc.dg/analyzer/data-model-13.c: New test. * gcc.dg/analyzer/data-model-14.c: New test. * gcc.dg/analyzer/data-model-15.c: New test. * gcc.dg/analyzer/data-model-16.c: New test. * gcc.dg/analyzer/data-model-17.c: New test. * gcc.dg/analyzer/data-model-18.c: New test. * gcc.dg/analyzer/data-model-19.c: New test. * gcc.dg/analyzer/data-model-path-1.c: New test. * gcc.dg/analyzer/disabling.c: New test. * gcc.dg/analyzer/dot-output.c: New test. * gcc.dg/analyzer/double-free-lto-1-a.c: New test. * gcc.dg/analyzer/double-free-lto-1-b.c: New test. * gcc.dg/analyzer/double-free-lto-1.h: New header. * gcc.dg/analyzer/equivalence.c: New test. * gcc.dg/analyzer/explode-1.c: New test. * gcc.dg/analyzer/explode-2.c: New test. * gcc.dg/analyzer/factorial.c: New test. * gcc.dg/analyzer/fibonacci.c: New test. * gcc.dg/analyzer/fields.c: New test. * gcc.dg/analyzer/file-1.c: New test. * gcc.dg/analyzer/file-2.c: New test. * gcc.dg/analyzer/function-ptr-1.c: New test. * gcc.dg/analyzer/function-ptr-2.c: New test. * gcc.dg/analyzer/function-ptr-3.c: New test. * gcc.dg/analyzer/gzio-2.c: New test. * gcc.dg/analyzer/gzio-3.c: New test. * gcc.dg/analyzer/gzio-3a.c: New test. * gcc.dg/analyzer/gzio.c: New test. * gcc.dg/analyzer/infinite-recursion.c: New test. * gcc.dg/analyzer/loop-2.c: New test. * gcc.dg/analyzer/loop-2a.c: New test. * gcc.dg/analyzer/loop-3.c: New test. * gcc.dg/analyzer/loop-4.c: New test. * gcc.dg/analyzer/loop.c: New test. * gcc.dg/analyzer/malloc-1.c: New test. * gcc.dg/analyzer/malloc-2.c: New test. * gcc.dg/analyzer/malloc-3.c: New test. * gcc.dg/analyzer/malloc-callbacks.c: New test. * gcc.dg/analyzer/malloc-dce.c: New test. * gcc.dg/analyzer/malloc-dedupe-1.c: New test. * gcc.dg/analyzer/malloc-ipa-1.c: New test. * gcc.dg/analyzer/malloc-ipa-10.c: New test. * gcc.dg/analyzer/malloc-ipa-11.c: New test. * gcc.dg/analyzer/malloc-ipa-12.c: New test. * gcc.dg/analyzer/malloc-ipa-13.c: New test. * gcc.dg/analyzer/malloc-ipa-2.c: New test. * gcc.dg/analyzer/malloc-ipa-3.c: New test. * gcc.dg/analyzer/malloc-ipa-4.c: New test. * gcc.dg/analyzer/malloc-ipa-5.c: New test. * gcc.dg/analyzer/malloc-ipa-6.c: New test. * gcc.dg/analyzer/malloc-ipa-7.c: New test. * gcc.dg/analyzer/malloc-ipa-8-double-free.c: New test. * gcc.dg/analyzer/malloc-ipa-8-lto-a.c: New test. * gcc.dg/analyzer/malloc-ipa-8-lto-b.c: New test. * gcc.dg/analyzer/malloc-ipa-8-lto-c.c: New test. * gcc.dg/analyzer/malloc-ipa-8-lto.h: New test. * gcc.dg/analyzer/malloc-ipa-8-unchecked.c: New test. * gcc.dg/analyzer/malloc-ipa-9.c: New test. * gcc.dg/analyzer/malloc-macro-inline-events.c: New test. * gcc.dg/analyzer/malloc-macro-separate-events.c: New test. * gcc.dg/analyzer/malloc-macro.h: New header. * gcc.dg/analyzer/malloc-many-paths-1.c: New test. * gcc.dg/analyzer/malloc-many-paths-2.c: New test. * gcc.dg/analyzer/malloc-many-paths-3.c: New test. * gcc.dg/analyzer/malloc-paths-1.c: New test. * gcc.dg/analyzer/malloc-paths-10.c: New test. * gcc.dg/analyzer/malloc-paths-2.c: New test. * gcc.dg/analyzer/malloc-paths-3.c: New test. * gcc.dg/analyzer/malloc-paths-4.c: New test. * gcc.dg/analyzer/malloc-paths-5.c: New test. * gcc.dg/analyzer/malloc-paths-6.c: New test. * gcc.dg/analyzer/malloc-paths-7.c: New test. * gcc.dg/analyzer/malloc-paths-8.c: New test. * gcc.dg/analyzer/malloc-paths-9.c: New test. * gcc.dg/analyzer/malloc-vs-local-1a.c: New test. * gcc.dg/analyzer/malloc-vs-local-1b.c: New test. * gcc.dg/analyzer/malloc-vs-local-2.c: New test. * gcc.dg/analyzer/malloc-vs-local-3.c: New test. * gcc.dg/analyzer/malloc-vs-local-4.c: New test. * gcc.dg/analyzer/operations.c: New test. * gcc.dg/analyzer/params-2.c: New test. * gcc.dg/analyzer/params.c: New test. * gcc.dg/analyzer/paths-1.c: New test. * gcc.dg/analyzer/paths-1a.c: New test. * gcc.dg/analyzer/paths-2.c: New test. * gcc.dg/analyzer/paths-3.c: New test. * gcc.dg/analyzer/paths-4.c: New test. * gcc.dg/analyzer/paths-5.c: New test. * gcc.dg/analyzer/paths-6.c: New test. * gcc.dg/analyzer/paths-7.c: New test. * gcc.dg/analyzer/pattern-test-1.c: New test. * gcc.dg/analyzer/pattern-test-2.c: New test. * gcc.dg/analyzer/pointer-merging.c: New test. * gcc.dg/analyzer/pr61861.c: New test. * gcc.dg/analyzer/pragma-1.c: New test. * gcc.dg/analyzer/scope-1.c: New test. * gcc.dg/analyzer/sensitive-1.c: New test. * gcc.dg/analyzer/setjmp-1.c: New test. * gcc.dg/analyzer/setjmp-2.c: New test. * gcc.dg/analyzer/setjmp-3.c: New test. * gcc.dg/analyzer/setjmp-4.c: New test. * gcc.dg/analyzer/setjmp-5.c: New test. * gcc.dg/analyzer/setjmp-6.c: New test. * gcc.dg/analyzer/setjmp-7.c: New test. * gcc.dg/analyzer/setjmp-7a.c: New test. * gcc.dg/analyzer/setjmp-8.c: New test. * gcc.dg/analyzer/setjmp-9.c: New test. * gcc.dg/analyzer/signal-1.c: New test. * gcc.dg/analyzer/signal-2.c: New test. * gcc.dg/analyzer/signal-3.c: New test. * gcc.dg/analyzer/signal-4a.c: New test. * gcc.dg/analyzer/signal-4b.c: New test. * gcc.dg/analyzer/strcmp-1.c: New test. * gcc.dg/analyzer/switch.c: New test. * gcc.dg/analyzer/taint-1.c: New test. * gcc.dg/analyzer/zlib-1.c: New test. * gcc.dg/analyzer/zlib-2.c: New test. * gcc.dg/analyzer/zlib-3.c: New test. * gcc.dg/analyzer/zlib-4.c: New test. * gcc.dg/analyzer/zlib-5.c: New test. * gcc.dg/analyzer/zlib-6.c: New test. * lib/gcc-defs.exp (dg-check-dot): New procedure. * lib/target-supports.exp (check_dot_available): New procedure. (check_effective_target_analyzer): New. * lib/target-supports-dg.exp (dg-require-dot): New procedure.
generated by cgit v1.1 at 2025-09-20 22:36:26 +0000