gcc/analyzer/ChangeLog

   1 2021-07-19  David Malcolm  <dmalcolm@redhat.com>
   2
   3         PR analyzer/101503
   4         * constraint-manager.cc (constraint_manager::add_constraint): Use
   5         can_have_associated_state_p rather than testing for unknown.
   6         (constraint_manager::get_or_add_equiv_class): Likewise.
   7         * program-state.cc (sm_state_map::set_state): Likewise.
   8         (sm_state_map::impl_set_state): Add assertion.
   9         * region-model-manager.cc
  10         (region_model_manager::maybe_fold_unaryop): Handle poisoned
  11         values.
  12         (region_model_manager::maybe_fold_binop): Move handling of unknown
  13         values...
  14         (region_model_manager::get_or_create_binop): ...to here, and
  15         generalize to use can_have_associated_state_p.
  16         (region_model_manager::maybe_fold_sub_svalue): Use
  17         can_have_associated_state_p rather than testing for unknown.
  18         (region_model_manager::maybe_fold_repeated_svalue): Use unknown
  19         when the size or repeated value is "unknown"/"poisoned".
  20         * region-model.cc (region_model::purge_state_involving): Reject
  21         attempts to purge unknown/poisoned svalues, as these svalues
  22         should not have state associated with them.
  23         * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
  24         on top of an svalue with can_have_associated_state_p.
  25         (repeated_svalue::repeated_svalue): Likewise.
  26         (bits_within_svalue::bits_within_svalue): Likewise.
  27         * svalue.h (svalue::can_have_associated_state_p): New.
  28         (unknown_svalue::can_have_associated_state_p): New.
  29         (poisoned_svalue::can_have_associated_state_p): New.
  30         (unaryop_svalue::unaryop_svalue): Assert that we're building on
  31         top of an svalue with can_have_associated_state_p.
  32         (binop_svalue::binop_svalue): Likewise.
  33         (widening_svalue::widening_svalue): Likewise.
  34
  35 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
  36
  37         * analyzer.h (enum access_direction): New.
  38         * engine.cc (exploded_node::on_longjmp): Update for new param of
  39         get_store_value.
  40         * program-state.cc (program_state::prune_for_point): Likewise.
  41         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
  42         Replace call to check_for_writable_region with call to
  43         check_region_for_write.
  44         (region_model::impl_call_memset): Likewise.
  45         (region_model::impl_call_strcpy): Likewise.
  46         * region-model-reachability.cc (reachable_regions::add): Update
  47         for new param of get_store_value.
  48         * region-model.cc (region_model::get_rvalue_1): Likewise, also for
  49         get_rvalue_for_bits.
  50         (region_model::get_store_value): Add ctxt param and use it to call
  51         check_region_for_read.
  52         (region_model::get_rvalue_for_bits): Add ctxt param and use it to
  53         call get_store_value.
  54         (region_model::check_region_access): New.
  55         (region_model::check_region_for_write): New.
  56         (region_model::check_region_for_read): New.
  57         (region_model::set_value): Update comment.  Replace call to
  58         check_for_writable_region with call to check_region_for_write.
  59         * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
  60         param.
  61         (region_model::get_store_value): Add ctxt param.
  62         (region_model::check_region_access): New decl.
  63         (region_model::check_region_for_write): New decl.
  64         (region_model::check_region_for_read): New decl.
  65         * region.cc (region_model::copy_region): Update call to
  66         get_store_value.
  67         * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
  68
  69 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
  70
  71         * engine.cc (exploded_node::on_stmt_pre): Handle
  72         __analyzer_dump_state.
  73         * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
  74         (program_state::impl_call_analyzer_dump_state): New.
  75         * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
  76         (program_state::impl_call_analyzer_dump_state): New decl.
  77         * region-model-impl-calls.cc
  78         (call_details::get_arg_string_literal): New.
  79         * region-model.h (call_details::get_arg_string_literal): New decl.
  80
  81 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
  82
  83         * program-state.cc (program_state::detect_leaks): Simplify using
  84         svalue::maybe_get_region.
  85         * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
  86         (region_model::impl_call_fread): Likewise.
  87         (region_model::impl_call_free): Likewise.
  88         (region_model::impl_call_operator_delete): Likewise.
  89         * region-model.cc (selftest::test_stack_frames): Likewise.
  90         (selftest::test_state_merging): Likewise.
  91         * svalue.cc (svalue::maybe_get_region): New.
  92         * svalue.h (svalue::maybe_get_region): New decl.
  93
  94 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
  95
  96         * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
  97         param and template param const.
  98         (is_a_helper <widening_svalue *>::test): Likewise.
  99         (is_a_helper <compound_svalue *>::test): Likewise.
 100         (is_a_helper <conjured_svalue *>::test): Likewise.
 101
 102 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 103
 104         PR analyzer/95006
 105         PR analyzer/94713
 106         PR analyzer/94714
 107         * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
 108         GIMPLE_ASSIGN case into...
 109         (get_diagnostic_tree_for_gassign_1): New.
 110         (get_diagnostic_tree_for_gassign): New.
 111         * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
 112         * analyzer.opt (Wanalyzer-write-to-string-literal): New.
 113         * constraint-manager.cc (class svalue_purger): New.
 114         (constraint_manager::purge_state_involving): New.
 115         * constraint-manager.h
 116         (constraint_manager::purge_state_involving): New.
 117         * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
 118         (dedupe_winners::handle_interactions): New.
 119         (diagnostic_manager::emit_saved_diagnostics): Call it.
 120         * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
 121         * engine.cc (impl_region_model_context::warn): Convert return type
 122         to bool.  Return false if the diagnostic isn't saved.
 123         (impl_region_model_context::purge_state_involving): New.
 124         (impl_sm_context::get_state): Use NULL ctxt when querying old
 125         rvalue.
 126         (impl_sm_context::set_next_state): Use new sval when querying old
 127         state.
 128         (class dump_path_diagnostic): Move to region-model.cc
 129         (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
 130         Remove call to purge_state_involving.
 131         (exploded_node::on_stmt_pre): New, based on the above.  Move most
 132         of it to region_model::on_stmt_pre.
 133         (exploded_node::on_stmt_post): Likewise, moving to
 134         region_model::on_stmt_post.
 135         (class stale_jmp_buf): Fix parent class to use curiously recurring
 136         template pattern.
 137         (feasibility_state::maybe_update_for_edge): Call on_call_pre and
 138         on_call_post on gcalls.
 139         * exploded-graph.h (impl_region_model_context::warn): Return bool.
 140         (impl_region_model_context::purge_state_involving): New decl.
 141         (exploded_node::on_stmt_pre): New decl.
 142         (exploded_node::on_stmt_post): New decl.
 143         * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
 144         (pending_diagnostic::supercedes_p): New.
 145         * program-state.cc (sm_state_map::get_state): Inherit state for
 146         conjured_svalue as well as initial_svalue.
 147         (sm_state_map::purge_state_involving): Also support SK_CONJURED.
 148         * region-model-impl-calls.cc (call_details::get_uncertainty):
 149         Handle m_ctxt being NULL.
 150         (call_details::get_or_create_conjured_svalue): New.
 151         (region_model::impl_call_fgets): New.
 152         (region_model::impl_call_fread): New.
 153         * region-model-manager.cc
 154         (region_model_manager::get_or_create_initial_value): Return an
 155         uninitialized poisoned value for regions that can't have initial
 156         values.
 157         * region-model-reachability.cc
 158         (reachable_regions::mark_escaped_clusters): Handle ctxt being
 159         NULL.
 160         * region-model.cc (region_to_value_map::purge_state_involving): New.
 161         (poisoned_value_diagnostic::use_of_uninit_p): New.
 162         (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
 163         (poisoned_value_diagnostic::describe_final_event): Likewise.
 164         (region_model::check_for_poison): New.
 165         (region_model::on_assignment): Call it.
 166         (class dump_path_diagnostic): Move here from engine.cc.
 167         (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
 168         (region_model::on_call_pre): Move the setting of the LHS to a
 169         conjured svalue to before the checks for specific functions.
 170         Handle "fgets", "fgets_unlocked", and "fread".
 171         (region_model::purge_state_involving): New.
 172         (region_model::handle_unrecognized_call): Handle ctxt being NULL.
 173         (region_model::get_rvalue): Call check_for_poison.
 174         (selftest::test_stack_frames): Use NULL for context when getting
 175         uninitialized rvalue.
 176         (selftest::test_alloca): Likewise.
 177         * region-model.h (region_to_value_map::purge_state_involving): New
 178         decl.
 179         (call_details::get_or_create_conjured_svalue): New decl.
 180         (region_model::on_stmt_pre): New decl.
 181         (region_model::purge_state_involving): New decl.
 182         (region_model::impl_call_fgets): New decl.
 183         (region_model::impl_call_fread): New decl.
 184         (region_model::check_for_poison): New decl.
 185         (region_model_context::warn): Return bool.
 186         (region_model_context::purge_state_involving): New.
 187         (noop_region_model_context::warn): Return bool.
 188         (noop_region_model_context::purge_state_involving): New.
 189         (test_region_model_context:: warn): Return bool.
 190         * region.cc (region::get_memory_space): New.
 191         (region::can_have_initial_svalue_p): New.
 192         (region::involves_p): New.
 193         * region.h (enum memory_space): New.
 194         (region::get_memory_space): New decl.
 195         (region::can_have_initial_svalue_p): New decl.
 196         (region::involves_p): New decl.
 197         * sm-malloc.cc (use_after_free::supercedes_p): New.
 198         * store.cc (binding_cluster::purge_state_involving): New.
 199         (store::purge_state_involving): New.
 200         * store.h (class symbolic_binding): New forward decl.
 201         (binding_key::dyn_cast_symbolic_binding): New.
 202         (symbolic_binding::dyn_cast_symbolic_binding): New.
 203         (binding_cluster::purge_state_involving): New.
 204         (store::purge_state_involving): New.
 205         * svalue.cc (svalue::can_merge_p): Reject attempts to merge
 206         poisoned svalues with other svalues, so that we identify
 207         paths in which a variable is conditionally uninitialized.
 208         (involvement_visitor::visit_conjured_svalue): New.
 209         (svalue::involves_p): Also handle SK_CONJURED.
 210         (poison_kind_to_str): Handle POISON_KIND_UNINIT.
 211         (poisoned_svalue::maybe_fold_bits_within): New.
 212         * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
 213         (poisoned_svalue::maybe_fold_bits_within): New decl.
 214
 215 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 216
 217         * analyzer.opt (fdump-analyzer-exploded-paths): New.
 218         * diagnostic-manager.cc
 219         (diagnostic_manager::emit_saved_diagnostic): Implement it.
 220         * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
 221         use it to dump states if non-NULL.
 222         (exploded_path::dump): Likewise.
 223         (exploded_path::dump_to_file): New.
 224         * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
 225         param.
 226         (exploded_path::dump): Likewise.
 227         (exploded_path::dump): Likewise.
 228         (exploded_path::dump_to_file): New.
 229
 230 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 231
 232         * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
 233         if it's available.
 234         * engine.cc (readability): Likewise.
 235
 236 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
 237
 238         * state-purge.cc (self_referential_phi_p): New.
 239         (state_purge_per_ssa_name::process_point): Don't purge an SSA name
 240         at its def-stmt if the def-stmt is self-referential.
 241
 242 2021-07-07  David Malcolm  <dmalcolm@redhat.com>
 243
 244         * diagnostic-manager.cc (null_assignment_sm_context::get_state):
 245         New overload.
 246         (null_assignment_sm_context::set_next_state): New overload.
 247         (null_assignment_sm_context::get_diagnostic_tree): New.
 248         * engine.cc (impl_sm_context::get_state): New overload.
 249         (impl_sm_context::set_next_state): New overload.
 250         (impl_sm_context::get_diagnostic_tree): New overload.
 251         (impl_region_model_context::on_condition): Convert params from
 252         tree to const svalue *.
 253         * exploded-graph.h (impl_region_model_context::on_condition):
 254         Likewise.
 255         * region-model.cc (region_model::on_call_pre): Move handling of
 256         internal calls to before checking for get_fndecl_for_call.
 257         (region_model::add_constraints_from_binop): New.
 258         (region_model::add_constraint): Split out into a new overload
 259         working on const svalue * rather than tree.  Call
 260         add_constraints_from_binop.  Drop call to
 261         add_any_constraints_from_ssa_def_stmt.
 262         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
 263         (region_model::add_any_constraints_from_gassign): Delete.
 264         (region_model::add_any_constraints_from_gcall): Delete.
 265         * region-model.h
 266         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
 267         (region_model::add_any_constraints_from_gassign): Delete.
 268         (region_model::add_any_constraints_from_gcall): Delete.
 269         (region_model::add_constraint): Add overload decl.
 270         (region_model::add_constraints_from_binop): New decl.
 271         (region_model_context::on_condition): Convert params from tree to
 272         const svalue *.
 273         (noop_region_model_context::on_condition): Likewise.
 274         * sm-file.cc (fileptr_state_machine::condition): Likewise.
 275         * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
 276         * sm-pattern-test.cc: Include tristate.h, selftest.h,
 277         analyzer/call-string.h, analyzer/program-point.h,
 278         analyzer/store.h, and analyzer/region-model.h.
 279         (pattern_test_state_machine::on_condition): Convert params from tree to
 280         const svalue *.
 281         * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
 282         * sm-signal.cc (signal_state_machine::on_condition): Delete.
 283         * sm-taint.cc (taint_state_machine::on_condition): Convert params
 284         from tree to const svalue *.
 285         * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
 286         analyzer/program-point.h, analyzer/store.h, and
 287         analyzer/region-model.h.
 288         (any_pointer_p): Add overload taking const svalue *sval.
 289         * sm.h (any_pointer_p): Add overload taking const svalue *sval.
 290         (state_machine::on_condition): Convert params from tree to
 291         const svalue *.  Provide no-op default implementation.
 292         (sm_context::get_state): Add overload taking const svalue *sval.
 293         (sm_context::set_next_state): Likewise.
 294         (sm_context::on_transition): Likewise.
 295         (sm_context::get_diagnostic_tree): Likewise.
 296         * svalue.cc (svalue::all_zeroes_p): New.
 297         (constant_svalue::all_zeroes_p): New.
 298         (repeated_svalue::all_zeroes_p): Convert to vfunc.
 299         * svalue.h (svalue::all_zeroes_p): New decl.
 300         (constant_svalue::all_zeroes_p): New decl.
 301         (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
 302
 303 2021-06-30  David Malcolm  <dmalcolm@redhat.com>
 304
 305         PR analyzer/95006
 306         * analyzer.h (class repeated_svalue): New forward decl.
 307         (class bits_within_svalue): New forward decl.
 308         (class sized_region): New forward decl.
 309         (get_field_at_bit_offset): New forward decl.
 310         * engine.cc (exploded_graph::get_or_create_node): Validate the
 311         merged state.
 312         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
 313         Validate the states at each stage.
 314         * program-state.cc (program_state::validate): Validate
 315         m_region_model.
 316         * region-model-impl-calls.cc (region_model::impl_call_memset):
 317         Replace special-case logic for handling constant sizes with
 318         a call to fill_region of a sized_region with the given fill value.
 319         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
 320         Drop DK_direct.
 321         (region_model_manager::maybe_fold_sub_svalue):  Fold element-based
 322         subregions of an initial value into initial values of an element.
 323         Fold subvalues of repeated svalues.
 324         (region_model_manager::maybe_fold_repeated_svalue): New.
 325         (region_model_manager::get_or_create_repeated_svalue): New.
 326         (get_bit_range_for_field): New.
 327         (get_byte_range_for_field): New.
 328         (get_field_at_byte_range): New.
 329         (region_model_manager::maybe_fold_bits_within_svalue): New.
 330         (region_model_manager::get_or_create_bits_within): New.
 331         (region_model_manager::get_sized_region): New.
 332         (region_model_manager::log_stats): Update for addition of
 333         m_repeated_values_map, m_bits_within_values_map, and
 334         m_sized_regions.
 335         * region-model.cc (region_model::validate): New.
 336         (region_model::on_assignment): Drop enum binding_kind.
 337         (region_model::get_initial_value_for_global): Likewise.
 338         (region_model::get_rvalue_for_bits): Replace body with call to
 339         get_or_create_bits_within.
 340         (region_model::get_capacity): Handle RK_SIZED.
 341         (region_model::set_value): Drop enum binding_kind.
 342         (region_model::fill_region): New.
 343         (region_model::get_representative_path_var_1): Handle RK_SIZED.
 344         * region-model.h (visitor::visit_repeated_svalue): New.
 345         (visitor::visit_bits_within_svalue): New.
 346         (region_model_manager::get_or_create_repeated_svalue): New decl.
 347         (region_model_manager::get_or_create_bits_within): New decl.
 348         (region_model_manager::get_sized_region): New decl.
 349         (region_model_manager::maybe_fold_repeated_svalue): New decl.
 350         (region_model_manager::maybe_fold_bits_within_svalue): New decl.
 351         (region_model_manager::repeated_values_map_t): New typedef.
 352         (region_model_manager::m_repeated_values_map): New field.
 353         (region_model_manager::bits_within_values_map_t): New typedef.
 354         (region_model_manager::m_bits_within_values_map): New field.
 355         (region_model_manager::m_sized_regions): New field.
 356         (region_model::fill_region): New decl.
 357         * region.cc (region::get_base_region): Handle RK_SIZED.
 358         (region::base_region_p): Likewise.
 359         (region::get_byte_size_sval): New.
 360         (get_field_at_bit_offset): Make non-static.
 361         (region::calc_offset): Move implementation of cases to
 362         get_relative_concrete_offset vfunc implementations.  Handle
 363         RK_SIZED.
 364         (region::get_relative_concrete_offset): New.
 365         (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
 366         (field_region::get_relative_concrete_offset): New, from
 367         region::calc_offset.
 368         (element_region::get_relative_concrete_offset): Likewise.
 369         (offset_region::get_relative_concrete_offset): Likewise.
 370         (sized_region::accept): New.
 371         (sized_region::dump_to_pp): New.
 372         (sized_region::get_byte_size): New.
 373         (sized_region::get_bit_size): New.
 374         * region.h (enum region_kind): Add RK_SIZED.
 375         (region::dyn_cast_sized_region): New.
 376         (region::get_byte_size): Make virtual.
 377         (region::get_bit_size): Likewise.
 378         (region::get_byte_size_sval): New decl.
 379         (region::get_relative_concrete_offset): New decl.
 380         (field_region::get_relative_concrete_offset): New decl.
 381         (element_region::get_relative_concrete_offset): Likewise.
 382         (offset_region::get_relative_concrete_offset): Likewise.
 383         (class sized_region): New.
 384         * store.cc (binding_kind_to_string): Delete.
 385         (binding_key::make): Drop enum binding_kind.
 386         (binding_key::dump_to_pp): Delete.
 387         (binding_key::cmp_ptrs): Drop enum binding_kind.
 388         (bit_range::contains_p): New.
 389         (byte_range::dump): New.
 390         (byte_range::contains_p): New.
 391         (byte_range::cmp): New.
 392         (concrete_binding::dump_to_pp): Drop enum binding_kind.
 393         (concrete_binding::cmp_ptr_ptr): Likewise.
 394         (symbolic_binding::dump_to_pp): Likewise.
 395         (symbolic_binding::cmp_ptr_ptr): Likewise.
 396         (binding_map::apply_ctor_val_to_range): Likewise.
 397         (binding_map::apply_ctor_pair_to_child_region): Likewise.
 398         (binding_map::get_overlapping_bindings): New.
 399         (binding_map::remove_overlapping_bindings): New.
 400         (binding_cluster::validate): New.
 401         (binding_cluster::bind): Drop enum binding_kind.
 402         (binding_cluster::bind_compound_sval): Likewise.
 403         (binding_cluster::purge_region): Likewise.
 404         (binding_cluster::zero_fill_region): Reimplement in terms of...
 405         (binding_cluster::fill_region): New.
 406         (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
 407         (binding_cluster::get_binding): Likewise.
 408         (binding_cluster::get_binding_recursive): Likewise.
 409         (binding_cluster::get_any_binding): Likewise.
 410         (binding_cluster::maybe_get_compound_binding): Reimplement.
 411         (binding_cluster::get_overlapping_bindings): Delete.
 412         (binding_cluster::remove_overlapping_bindings): Reimplement in
 413         terms of binding_map::remove_overlapping_bindings.
 414         (binding_cluster::can_merge_p): Update for removal of
 415         enum binding_kind.
 416         (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
 417         (binding_cluster::maybe_get_simple_value): Likewise.
 418         (store_manager::get_concrete_binding): Likewise.
 419         (store_manager::get_symbolic_binding): Likewise.
 420         (store::validate): New.
 421         (store::set_value): Drop enum binding_kind.
 422         (store::zero_fill_region): Reimplement in terms of...
 423         (store::fill_region): New.
 424         (selftest::test_binding_key_overlap): Drop enum binding_kind.
 425         * store.h (enum binding_kind): Delete.
 426         (binding_kind_to_string): Delete decl.
 427         (binding_key::make): Drop enum binding_kind.
 428         (binding_key::dump_to_pp): Make pure virtual.
 429         (binding_key::get_kind): Delete.
 430         (binding_key::mark_deleted): Delete.
 431         (binding_key::mark_empty): Delete.
 432         (binding_key::is_deleted): Delete.
 433         (binding_key::is_empty): Delete.
 434         (binding_key::binding_key): Delete.
 435         (binding_key::impl_hash): Delete.
 436         (binding_key::impl_eq): Delete.
 437         (binding_key::m_kind): Delete.
 438         (bit_range::get_last_bit_offset): New.
 439         (bit_range::contains_p): New.
 440         (byte_range::contains_p): New.
 441         (byte_range::operator==): New.
 442         (byte_range::get_start_byte_offset): New.
 443         (byte_range::get_next_byte_offset): New.
 444         (byte_range::get_last_byte_offset): New.
 445         (byte_range::as_bit_range): New.
 446         (byte_range::cmp): New.
 447         (concrete_binding::concrete_binding): Drop enum binding_kind.
 448         (concrete_binding::hash): Likewise.
 449         (concrete_binding::operator==): Likewise.
 450         (concrete_binding::mark_deleted): New.
 451         (concrete_binding::mark_empty): New.
 452         (concrete_binding::is_deleted): New.
 453         (concrete_binding::is_empty): New.
 454         (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
 455         (symbolic_binding::symbolic_binding): Drop enum binding_kind.
 456         (symbolic_binding::hash): Likewise.
 457         (symbolic_binding::operator==): Likewise.
 458         (symbolic_binding::mark_deleted): New.
 459         (symbolic_binding::mark_empty): New.
 460         (symbolic_binding::is_deleted): New.
 461         (symbolic_binding::is_empty): New.
 462         (binding_map::remove_overlapping_bindings): New decl.
 463         (binding_map::get_overlapping_bindings): New decl.
 464         (binding_cluster::validate): New decl.
 465         (binding_cluster::bind): Drop enum binding_kind.
 466         (binding_cluster::fill_region): New decl.
 467         (binding_cluster::get_binding): Drop enum binding_kind.
 468         (binding_cluster::get_binding_recursive): Likewise.
 469         (binding_cluster::get_overlapping_bindings): Delete.
 470         (store::validate): New decl.
 471         (store::set_value): Drop enum binding_kind.
 472         (store::fill_region): New decl.
 473         (store_manager::get_concrete_binding): Drop enum binding_kind.
 474         (store_manager::get_symbolic_binding): Likewise.
 475         * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
 476         SK_BITS_WITHIN.
 477         (svalue::extract_bit_range): New.
 478         (svalue::maybe_fold_bits_within): New.
 479         (constant_svalue::maybe_fold_bits_within): New.
 480         (unknown_svalue::maybe_fold_bits_within): New.
 481         (unaryop_svalue::maybe_fold_bits_within): New.
 482         (repeated_svalue::repeated_svalue): New.
 483         (repeated_svalue::dump_to_pp): New.
 484         (repeated_svalue::accept): New.
 485         (repeated_svalue::all_zeroes_p): New.
 486         (repeated_svalue::maybe_fold_bits_within): New.
 487         (bits_within_svalue::bits_within_svalue): New.
 488         (bits_within_svalue::dump_to_pp): New.
 489         (bits_within_svalue::maybe_fold_bits_within): New.
 490         (bits_within_svalue::accept): New.
 491         (bits_within_svalue::implicitly_live_p): New.
 492         (compound_svalue::maybe_fold_bits_within): New.
 493         * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
 494         (svalue::dyn_cast_repeated_svalue): New.
 495         (svalue::dyn_cast_bits_within_svalue): New.
 496         (svalue::extract_bit_range): New decl.
 497         (svalue::maybe_fold_bits_within): New vfunc decl.
 498         (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 499         (region_svalue::key_t::is_empty): Likewise.
 500         (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
 501         (constant_svalue::maybe_fold_bits_within): New.
 502         (unknown_svalue::maybe_fold_bits_within): New.
 503         (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 504         (poisoned_svalue::key_t::is_empty): Likewise.
 505         (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
 506         false.
 507         (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 508         (setjmp_svalue::key_t::is_empty): Likewise.
 509         (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
 510         false.
 511         (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 512         (unaryop_svalue::key_t::is_empty): Likewise.
 513         (unaryop_svalue::maybe_fold_bits_within): New.
 514         (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
 515         false.
 516         (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 517         (binop_svalue::key_t::is_empty): Likewise.
 518         (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
 519         false.
 520         (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 521         (sub_svalue::key_t::is_empty): Likewise.
 522         (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
 523         false.
 524         (class repeated_svalue): New.
 525         (is_a_helper <const repeated_svalue *>::test): New.
 526         (struct default_hash_traits<repeated_svalue::key_t>): New.
 527         (class bits_within_svalue): New.
 528         (is_a_helper <const bits_within_svalue *>::test): New.
 529         (struct default_hash_traits<bits_within_svalue::key_t>): New.
 530         (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 531         (widening_svalue::key_t::is_empty): Likewise.
 532         (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
 533         false.
 534         (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
 535         (compound_svalue::key_t::is_empty): Likewise.
 536         (compound_svalue::maybe_fold_bits_within): New.
 537         (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
 538         false.
 539
 540 2021-06-28  David Malcolm  <dmalcolm@redhat.com>
 541
 542         * analyzer.h (byte_offset_t): New typedef.
 543         * store.cc (bit_range::dump_to_pp): Dump as a byte range if
 544         possible.
 545         (bit_range::as_byte_range): New.
 546         (byte_range::dump_to_pp): New.
 547         * store.h (class byte_range): New forward decl.
 548         (struct bit_range): Add comment.
 549         (bit_range::as_byte_range): New decl.
 550         (struct byte_range): New.
 551
 552 2021-06-22  David Malcolm  <dmalcolm@redhat.com>
 553
 554         PR analyzer/101143
 555         * region-model.cc (compat_types_p): New function.
 556         (region_model::create_region_for_heap_alloc): Convert assertion to
 557         an error check.
 558         (region_model::create_region_for_alloca): Likewise.
 559
 560 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
 561
 562         * store.cc (binding_cluster::get_any_binding): Make symbolic reads
 563         from a cluster with concrete bindings return unknown.
 564
 565 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
 566
 567         * region-model-manager.cc
 568         (region_model_manager::get_or_create_int_cst): New.
 569         (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
 570         it to simplify away a local tree.
 571         * region-model.cc (region_model::on_setjmp): Likewise.
 572         (region_model::on_longjmp): Likewise.
 573         * region-model.h (region_model_manager::get_or_create_int_cst):
 574         New decl.
 575         * store.cc (binding_cluster::zero_fill_region): Use it to simplify
 576         away a local tree.
 577
 578 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
 579
 580         * checker-path.cc (class custom_event): Make abstract to allow for
 581         custom vfuncs, splitting existing implementation into...
 582         (class precanned_custom_event): New subclass.
 583         (custom_event::get_desc): Move to...
 584         (precanned_custom_event::get_desc): ...subclass.
 585         * checker-path.h (class custom_event): Make abstract to allow for
 586         custom vfuncs, splitting existing implementation into...
 587         (class precanned_custom_event): New subclass.
 588         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
 589         Use precanned_custom_event.
 590         * engine.cc
 591         (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
 592         * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
 593         Likewise.
 594
 595 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
 596
 597         PR analyzer/99212
 598         PR analyzer/101082
 599         * engine.cc: Include "target.h".
 600         (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
 601         WORDS_BIG_ENDIAN.
 602         * region-model-manager.cc
 603         (region_model_manager::maybe_fold_binop): Move support for masking
 604         via ARG0 & CST into...
 605         (region_model_manager::maybe_undo_optimize_bit_field_compare):
 606         ...this new function.  Flatten by converting from nested
 607         conditionals to a series of early return statements to reject
 608         failures.  Reject if type is not unsigned_char_type_node.
 609         Handle BYTES_BIG_ENDIAN when determining which bits are bound
 610         in the binding_map.
 611         * region-model.h
 612         (region_model_manager::maybe_undo_optimize_bit_field_compare):
 613         New decl.
 614         * store.cc (bit_range::dump): New function.
 615         * store.h (bit_range::dump): New decl.
 616
 617 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
 618
 619         * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
 620         (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
 621         (state_change_requires_new_enode_p): New function...
 622         (exploded_graph::process_node): Call it, rather than querying
 623         flags.m_sm_changes, so that dynamic-extent differences can also
 624         trigger the splitting of nodes.
 625         * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
 626         * program-state.cc (program_state::detect_leaks): Purge dead
 627         heap-allocated regions from dynamic extents.
 628         (selftest::test_program_state_1): Fix type of "size_in_bytes".
 629         (selftest::test_program_state_merging): Likewise.
 630         * region-model-impl-calls.cc
 631         (region_model::impl_call_analyzer_dump_capacity): New.
 632         (region_model::impl_call_free): Remove dynamic extents from the
 633         freed region.
 634         * region-model-reachability.h
 635         (reachable_regions::begin_mutable_base_regs): New.
 636         (reachable_regions::end_mutable_base_regs): New.
 637         * region-model.cc: Include "tree-object-size.h".
 638         (region_model::region_model): Support new field m_dynamic_extents.
 639         (region_model::operator=): Likewise.
 640         (region_model::operator==): Likewise.
 641         (region_model::dump_to_pp): Dump sizes of dynamic regions.
 642         (region_model::handle_unrecognized_call): Purge dynamic extents
 643         from any regions that have escaped mutably:.
 644         (region_model::get_capacity): New function.
 645         (region_model::add_constraint): Unset dynamic extents when a
 646         heap-allocated region's address is NULL.
 647         (region_model::unbind_region_and_descendents): Purge dynamic
 648         extents of unbound regions.
 649         (region_model::can_merge_with_p): Call
 650         m_dynamic_extents.can_merge_with_p.
 651         (region_model::create_region_for_heap_alloc): Assert that
 652         size_in_bytes's type is compatible with size_type_node.  Update
 653         for renaming of record_dynamic_extents to set_dynamic_extents.
 654         (region_model::create_region_for_alloca): Likewise.
 655         (region_model::record_dynamic_extents): Rename to...
 656         (region_model::set_dynamic_extents): ...this.  Assert that
 657         size_in_bytes's type is compatible with size_type_node.  Add it
 658         to the m_dynamic_extents map.
 659         (region_model::get_dynamic_extents): New.
 660         (region_model::unset_dynamic_extents): New.
 661         (selftest::test_state_merging): Fix type of "size".
 662         (selftest::test_malloc_constraints): Likewise.
 663         (selftest::test_malloc): Verify dynamic extents.
 664         (selftest::test_alloca): Likewise.
 665         * region-model.h (region_to_value_map::is_empty): New.
 666         (region_model::dynamic_extents_t): New typedef.
 667         (region_model::impl_call_analyzer_dump_capacity): New decl.
 668         (region_model::get_dynamic_extents): New function.
 669         (region_model::get_dynamic_extents): New decl.
 670         (region_model::set_dynamic_extents): New decl.
 671         (region_model::unset_dynamic_extents): New decl.
 672         (region_model::get_capacity): New decl.
 673         (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
 674         (region_model::m_dynamic_extents): New field.
 675
 676 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
 677
 678         * region-model.cc (region_to_value_map::operator=): New.
 679         (region_to_value_map::operator==): New.
 680         (region_to_value_map::dump_to_pp): New.
 681         (region_to_value_map::dump): New.
 682         (region_to_value_map::can_merge_with_p): New.
 683         * region-model.h (class region_to_value_map): New class.
 684
 685 2021-06-13  Trevor Saunders  <tbsaunde@tbsaunde.org>
 686
 687         * call-string.cc (call_string::call_string): Use range based for
 688         to iterate over vec<>.
 689         (call_string::to_json): Likewise.
 690         (call_string::hash): Likewise.
 691         (call_string::calc_recursion_depth): Likewise.
 692         * checker-path.cc (checker_path::fixup_locations): Likewise.
 693         * constraint-manager.cc (equiv_class::equiv_class): Likewise.
 694         (equiv_class::to_json): Likewise.
 695         (equiv_class::hash): Likewise.
 696         (constraint_manager::to_json): Likewise.
 697         * engine.cc (impl_region_model_context::on_svalue_leak):
 698         Likewise.
 699         (on_liveness_change): Likewise.
 700         (impl_region_model_context::on_unknown_change): Likewise.
 701         * program-state.cc (sm_state_map::set_state): Likewise.
 702         * region-model.cc (test_canonicalization_4): Likewise.
 703
 704 2021-06-11  David Malcolm  <dmalcolm@redhat.com>
 705
 706         * engine.cc (worklist::key_t::cmp): Move sort by call_string to
 707         before SCC.
 708
 709 2021-06-09  David Malcolm  <dmalcolm@redhat.com>
 710
 711         * region-model.cc (region_model::get_lvalue_1): Make const.
 712         (region_model::get_lvalue): Likewise.
 713         (region_model::get_rvalue_1): Likewise.
 714         (region_model::get_rvalue): Likewise.
 715         (region_model::deref_rvalue): Likewise.
 716         (region_model::get_rvalue_for_bits): Likewise.
 717         * region-model.h (region_model::get_lvalue): Likewise.
 718         (region_model::get_rvalue): Likewise.
 719         (region_model::deref_rvalue): Likewise.
 720         (region_model::get_rvalue_for_bits): Likewise.
 721         (region_model::get_lvalue_1): Likewise.
 722         (region_model::get_rvalue_1): Likewise.
 723
 724 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
 725
 726         PR analyzer/99212
 727         * region-model-manager.cc
 728         (region_model_manager::maybe_fold_binop): Add support for folding
 729         BIT_AND_EXPR of compound_svalue and a mask constant.
 730         * region-model.cc (region_model::get_rvalue_1): Implement
 731         BIT_FIELD_REF in terms of...
 732         (region_model::get_rvalue_for_bits): New function.
 733         * region-model.h (region_model::get_rvalue_for_bits): New decl.
 734         * store.cc (bit_range::from_mask): New function.
 735         (selftest::test_bit_range_intersects_p): New selftest.
 736         (selftest::assert_bit_range_from_mask_eq): New.
 737         (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
 738         (selftest::assert_no_bit_range_from_mask_eq): New.
 739         (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
 740         (selftest::test_bit_range_from_mask): New selftest.
 741         (selftest::analyzer_store_cc_tests): Call the new selftests.
 742         * store.h (bit_range::intersects_p): New.
 743         (bit_range::from_mask): New decl.
 744         (concrete_binding::get_bit_range): New accessor.
 745         (store_manager::get_concrete_binding): New overload taking
 746         const bit_range &.
 747
 748 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
 749
 750         * analyzer.h (int_size_in_bits): New decl.
 751         * region.cc (int_size_in_bits): New function.
 752         (region::get_bit_size): Reimplement in terms of the above.
 753
 754 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
 755
 756         * store.cc (concrete_binding::dump_to_pp): Move bulk of
 757         implementation to...
 758         (bit_range::dump_to_pp): ...this new function.
 759         (bit_range::cmp): New.
 760         (concrete_binding::overlaps_p): Update for use of bit_range.
 761         (concrete_binding::cmp_ptr_ptr): Likewise.
 762         * store.h (struct bit_range): New.
 763         (class concrete_binding): Replace fields m_start_bit_offset and
 764         m_size_in_bits with new field m_bit_range.
 765
 766 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
 767
 768         * svalue.h (conjured_svalue::iterator_t): Delete.
 769
 770 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
 771
 772         * store.h (store::get_direct_binding): Remove unused decl.
 773         (store::get_default_binding): Likewise.
 774
 775 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
 776
 777         * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
 778         (compound_svalue::dump_to_pp): Dump any type.
 779
 780 2021-05-18  David Malcolm  <dmalcolm@redhat.com>
 781
 782         PR analyzer/100615
 783         * sm-malloc.cc: Include "analyzer/function-set.h".
 784         (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
 785         bail on the functions it recognizes.
 786         (malloc_state_machine::unaffected_by_call_p): New.
 787
 788 2021-05-10  Martin Liska  <mliska@suse.cz>
 789
 790         * sm-file.cc (is_file_using_fn_p): Use startswith
 791         function instead of strncmp.
 792
 793 2021-05-10  Martin Liska  <mliska@suse.cz>
 794
 795         * program-state.cc (program_state::operator=): Remove
 796         __cplusplus >= 201103.
 797         (program_state::program_state): Likewise.
 798         * program-state.h: Likewise.
 799         * region-model.h (class region_model): Remove dead code.
 800
 801 2021-04-24  David Malcolm  <dmalcolm@redhat.com>
 802
 803         PR analyzer/100244
 804         * sm-malloc.cc (free_of_non_heap::describe_state_change):
 805         Bulletproof against change.m_expr being NULL.
 806
 807 2021-04-13  David Malcolm  <dmalcolm@redhat.com>
 808
 809         PR analyzer/98599
 810         * supergraph.cc (saved_uids::make_uid_unique): New.
 811         (saved_uids::restore_uids): New.
 812         (supergraph::supergraph): Replace assignments to stmt->uid with
 813         calls to m_stmt_uids.make_uid_unique.
 814         (supergraph::~supergraph): New.
 815         * supergraph.h (class saved_uids): New.
 816         (supergraph::~supergraph): New decl.
 817         (supergraph::m_stmt_uids): New field.
 818
 819 2021-04-10  David Malcolm  <dmalcolm@redhat.com>
 820
 821         PR analyzer/100011
 822         * region-model.cc (region_model::on_assignment): Avoid NULL
 823         dereference if ctxt is NULL when assigning from a STRING_CST.
 824
 825 2021-04-08  David Malcolm  <dmalcolm@redhat.com>
 826
 827         PR analyzer/99042
 828         PR analyzer/99774
 829         * engine.cc
 830         (impl_region_model_context::impl_region_model_context): Add
 831         uncertainty param and use it to initialize m_uncertainty.
 832         (impl_region_model_context::get_uncertainty): New.
 833         (impl_sm_context::get_fndecl_for_call): Add NULL for new
 834         uncertainty param when constructing impl_region_model_context.
 835         (impl_sm_context::get_state): Likewise.
 836         (impl_sm_context::set_next_state): Likewise.
 837         (impl_sm_context::warn): Likewise.
 838         (exploded_node::on_stmt): Add uncertainty param
 839         and use it when constructing impl_region_model_context.
 840         (exploded_node::on_edge): Add uncertainty param and pass
 841         to on_edge call.
 842         (exploded_node::detect_leaks): Create uncertainty_t and pass to
 843         impl_region_model_context.
 844         (exploded_graph::get_or_create_node): Create uncertainty_t and
 845         pass to prune_for_point.
 846         (maybe_process_run_of_before_supernode_enodes): Create
 847         uncertainty_t and pass to impl_region_model_context.
 848         (exploded_graph::process_node): Create uncertainty_t instances and
 849         pass around as needed.
 850         * exploded-graph.h
 851         (impl_region_model_context::impl_region_model_context): Add
 852         uncertainty param.
 853         (impl_region_model_context::get_uncertainty): New decl.
 854         (impl_region_model_context::m_uncertainty): New field.
 855         (exploded_node::on_stmt): Add uncertainty param.
 856         (exploded_node::on_edge): Likewise.
 857         * program-state.cc (sm_state_map::on_liveness_change): Get
 858         uncertainty from context and use it to unset sm-state from
 859         svalues as appropriate.
 860         (program_state::on_edge): Add uncertainty param and use it when
 861         constructing impl_region_model_context.  Fix indentation.
 862         (program_state::prune_for_point): Add uncertainty param and use it
 863         when constructing impl_region_model_context.
 864         (program_state::detect_leaks): Get any uncertainty from ctxt and
 865         use it to get maybe-live svalues for dest_state, rather than
 866         definitely-live ones; use this when determining which svalues
 867         have leaked.
 868         (selftest::test_program_state_merging): Create uncertainty_t and
 869         pass to impl_region_model_context.
 870         * program-state.h (program_state::on_edge): Add uncertainty param.
 871         (program_state::prune_for_point): Likewise.
 872         * region-model-impl-calls.cc (call_details::get_uncertainty): New.
 873         (region_model::impl_call_memcpy): Pass uncertainty to
 874         mark_region_as_unknown call.
 875         (region_model::impl_call_memset): Likewise.
 876         (region_model::impl_call_strcpy): Likewise.
 877         * region-model-reachability.cc (reachable_regions::handle_sval):
 878         Also add sval to m_mutable_svals.
 879         * region-model.cc (region_model::on_assignment): Pass any
 880         uncertainty from ctxt to the store::set_value call.
 881         (region_model::handle_unrecognized_call): Get any uncertainty from
 882         ctxt and use it to record mutable svalues at the unknown call.
 883         (region_model::get_reachable_svalues): Add uncertainty param and
 884         use it to mark any maybe-bound svalues as being reachable.
 885         (region_model::set_value): Pass any uncertainty from ctxt to the
 886         store::set_value call.
 887         (region_model::mark_region_as_unknown): Add uncertainty param and
 888         pass it on to the store::mark_region_as_unknown call.
 889         (region_model::update_for_call_summary): Add uncertainty param and
 890         pass it on to the region_model::mark_region_as_unknown call.
 891         * region-model.h (call_details::get_uncertainty): New decl.
 892         (region_model::get_reachable_svalues): Add uncertainty param.
 893         (region_model::mark_region_as_unknown): Add uncertainty param.
 894         (region_model_context::get_uncertainty): New vfunc.
 895         (noop_region_model_context::get_uncertainty): New vfunc
 896         implementation.
 897         * store.cc (dump_svalue_set): New.
 898         (uncertainty_t::dump_to_pp): New.
 899         (uncertainty_t::dump): New.
 900         (binding_cluster::clobber_region): Pass NULL for uncertainty to
 901         remove_overlapping_bindings.
 902         (binding_cluster::mark_region_as_unknown): Add uncertainty param
 903         and pass it to remove_overlapping_bindings.
 904         (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
 905         Use it to record any svalues that were in clobbered bindings.
 906         (store::set_value): Add uncertainty param.  Pass it to
 907         binding_cluster::mark_region_as_unknown when handling symbolic
 908         regions.
 909         (store::mark_region_as_unknown): Add uncertainty param and pass it
 910         to binding_cluster::mark_region_as_unknown.
 911         (store::remove_overlapping_bindings): Add uncertainty param and
 912         pass it to binding_cluster::remove_overlapping_bindings.
 913         * store.h (binding_cluster::mark_region_as_unknown): Add
 914         uncertainty param.
 915         (binding_cluster::remove_overlapping_bindings): Likewise.
 916         (store::set_value): Likewise.
 917         (store::mark_region_as_unknown): Likewise.
 918
 919 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
 920
 921         PR analyzer/99906
 922         * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
 923         dereference on calls with zero arguments.
 924         * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
 925         __attribute__((nonnull)), only call get_diagnostic_tree if the
 926         result will be used.
 927
 928 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
 929
 930         PR analyzer/99886
 931         * diagnostic-manager.cc
 932         (diagnostic_manager::prune_interproc_events): Use signed integers
 933         when subtracting one from path->num_events ().
 934         (diagnostic_manager::consolidate_conditions): Likewise.  Convert
 935         next_idx to a signed int.
 936
 937 2021-04-01  David Malcolm  <dmalcolm@redhat.com>
 938
 939         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
 940         enode param non-constant, and call add_diagnostic on it.  Add
 941         enode index to log message.
 942         (diagnostic_manager::add_diagnostic): Make enode param
 943         non-constant.
 944         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
 945         Likewise for both decls.
 946         * engine.cc
 947         (impl_region_model_context::impl_region_model_context): Likewise
 948         for enode_for_diag.
 949         (impl_sm_context::impl_sm_context): Likewise.
 950         (impl_sm_context::m_enode_for_diag): Likewise.
 951         (exploded_node::dump_dot): Don't pass the diagnostic manager
 952         to dump_saved_diagnostics.
 953         (exploded_node::dump_saved_diagnostics): Drop param.  Iterate
 954         directly through all saved diagnostics for the enode, rather
 955         than all saved diagnostics in the diagnostic_manager and
 956         filtering.
 957         (exploded_node::on_stmt): Make non-const.
 958         (exploded_node::on_edge): Likewise.
 959         (exploded_node::on_longjmp): Likewise.
 960         (exploded_node::detect_leaks): Likewise.
 961         (exploded_graph::get_or_create_node): Make enode_for_diag param
 962         non-const.
 963         (exploded_graph_annotator::print_enode): Iterate
 964         directly through all saved diagnostics for the enode, rather
 965         than all saved diagnostics in the diagnostic_manager and
 966         filtering.
 967         * exploded-graph.h
 968         (impl_region_model_context::impl_region_model_context): Make
 969         enode_for_diag param non-constant.
 970         (impl_region_model_context::m_enode_for_diag): Likewise.
 971         (exploded_node::dump_saved_diagnostics): Drop param.
 972         (exploded_node::on_stmt): Make non-const.
 973         (exploded_node::on_edge): Likewise.
 974         (exploded_node::on_longjmp): Likewise.
 975         (exploded_node::detect_leaks): Likewise.
 976         (exploded_node::add_diagnostic): New.
 977         (exploded_node::get_num_diagnostics): New.
 978         (exploded_node::get_saved_diagnostic): New.
 979         (exploded_node::m_saved_diagnostics): New.
 980         (exploded_graph::get_or_create_node): Make enode_for_diag param
 981         non-constant.
 982         * feasible-graph.cc (feasible_node::dump_dot): Drop
 983         diagnostic_manager from call to dump_saved_diagnostics.
 984         * program-state.cc (program_state::on_edge): Convert enode param
 985         to non-const pointer.
 986         (program_state::prune_for_point): Likewise for enode_for_diag
 987         param.
 988         * program-state.h (program_state::on_edge): Convert enode param
 989         to non-const pointer.
 990         (program_state::prune_for_point): Likewise for enode_for_diag
 991         param.
 992
 993 2021-03-31  David Malcolm  <dmalcolm@redhat.com>
 994
 995         PR analyzer/99771
 996         * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
 997         (fixup_tree_for_diagnostic_1): New.
 998         (fixup_tree_for_diagnostic): New.
 999         * analyzer.h (fixup_tree_for_diagnostic): New decl.
1000         * checker-path.cc (call_event::get_desc): Call
1001         fixup_tree_for_diagnostic and use it for the call_with_state call.
1002         (warning_event::get_desc): Likewise for the final_event and
1003         make_label_text calls.
1004         * engine.cc (impl_region_model_context::on_state_leak): Likewise
1005         for the on_leak and add_diagnostic calls.
1006         * region-model.cc (region_model::get_representative_tree):
1007         Likewise for the result.
1008
1009 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
1010
1011         * region.h (region::dump_to_pp): Remove old decl.
1012
1013 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
1014
1015         * sm-file.cc (fileptr_state_machine::on_stmt): Only call
1016         get_diagnostic_tree if the result will be used.
1017         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1018         (malloc_state_machine::on_deallocator_call): Likewise.
1019         (malloc_state_machine::on_realloc_call): Likewise.
1020         (malloc_state_machine::on_realloc_call): Likewise.
1021         * sm-sensitive.cc
1022         (sensitive_state_machine::warn_for_any_exposure): Likewise.
1023         * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
1024
1025 2021-03-25  David Malcolm  <dmalcolm@redhat.com>
1026
1027         PR analyzer/93695
1028         PR analyzer/99044
1029         PR analyzer/99716
1030         * engine.cc (exploded_node::on_stmt): Clear sm-state involving
1031         an SSA name at the def-stmt of that SSA name.
1032         * program-state.cc (sm_state_map::purge_state_involving): New.
1033         * program-state.h (sm_state_map::purge_state_involving): New decl.
1034         * region-model.cc (selftest::test_involves_p): New.
1035         (selftest::analyzer_region_model_cc_tests): Call it.
1036         * svalue.cc (class involvement_visitor): New class
1037         (svalue::involves_p): New.
1038         * svalue.h (svalue::involves_p): New decl.
1039
1040 2021-03-19  David Malcolm  <dmalcolm@redhat.com>
1041
1042         PR analyzer/99614
1043         * diagnostic-manager.cc (class epath_finder): Add
1044         DISABLE_COPY_AND_ASSIGN.
1045
1046 2021-03-15  Martin Liska  <mliska@suse.cz>
1047
1048         * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
1049
1050 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
1051
1052         PR analyzer/96374
1053         * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
1054         (fdump-analyzer-feasibility): New flag.
1055         * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
1056         "analyzer/feasible-graph.h".
1057         (epath_finder::epath_finder): Convert m_sep to a pointer and
1058         only create it if !flag_analyzer_feasibility.
1059         (epath_finder::~epath_finder): New.
1060         (epath_finder::m_sep): Convert to a pointer.
1061         (epath_finder::get_best_epath): Add param "diag_idx" and use it
1062         when logging.  Rather than finding the shortest path and then
1063         checking feasibility, instead use explore_feasible_paths unless
1064         !flag_analyzer_feasibility, in which case simply use the shortest
1065         path, and note if it is infeasible.  Update for m_sep becoming a
1066         pointer.
1067         (class feasible_worklist): New.
1068         (epath_finder::explore_feasible_paths): New.
1069         (epath_finder::process_worklist_item): New.
1070         (class dump_eg_with_shortest_path): New.
1071         (epath_finder::dump_trimmed_graph): New.
1072         (epath_finder::dump_feasible_graph): New.
1073         (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
1074         on new field m_idx.
1075         (saved_diagnostic::to_json): Dump m_idx.
1076         (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
1077         Remove assertion that m_problem was set when m_best_epath is NULL.
1078         (diagnostic_manager::add_diagnostic): Pass an index when created
1079         saved_diagnostic instances.
1080         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
1081         "idx" param.
1082         (saved_diagnostic::get_index): New accessor.
1083         (saved_diagnostic::m_idx): New field.
1084         * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
1085         Move code to...
1086         (exploded_node::dump_processed_stmts): ...this new function and...
1087         (exploded_node::dump_saved_diagnostics): ...this new function.
1088         Add index of each diagnostic.
1089         (exploded_edge::dump_dot):  Move bulk of code to...
1090         (exploded_edge::dump_dot_label): ...this new function.
1091         * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
1092         vfunc.
1093         (exploded_node::dump_processed_stmts): New decl.
1094         (exploded_node::dump_saved_diagnostics): New decl.
1095         (exploded_edge::dump_dot_label): New decl.
1096         * feasible-graph.cc: New file.
1097         * feasible-graph.h: New file.
1098         * trimmed-graph.cc: New file.
1099         * trimmed-graph.h: New file.
1100
1101 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
1102
1103         * diagnostic-manager.cc (epath_finder::epath_finder):
1104         Update shortest_paths init for new param.
1105
1106 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
1107
1108         PR analyzer/96374
1109         * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
1110         "model" locals into a new class feasibility_state.  Move heart
1111         of per-edge processing into
1112         feasibility_state::maybe_update_for_edge.
1113         (feasibility_state::feasibility_state): New.
1114         (feasibility_state::maybe_update_for_edge): New, based on loop
1115         body in exploded_path::feasible_p.
1116         * exploded-graph.h (class feasibility_state): New.
1117
1118 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
1119
1120         * supergraph.h
1121         (callgraph_superedge::dyn_cast_callgraph_superedge): New.
1122         (call_superedge::dyn_cast_callgraph_superedge): Delete.
1123         (return_superedge::dyn_cast_callgraph_superedge): Delete.
1124
1125 2021-03-02  Martin Liska  <mliska@suse.cz>
1126
1127         * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
1128         Do not pass engine.
1129
1130 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
1131
1132         * engine.cc (exploded_path::exploded_path): New copy-ctor.
1133         * exploded-graph.h (exploded_path::operator=): Drop decl.
1134
1135 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
1136
1137         PR analyzer/96374
1138         * diagnostic-manager.cc (class epath_finder): New.
1139         (epath_finder::get_best_epath): New.
1140         (saved_diagnostic::saved_diagnostic): Update for replacement of
1141         m_state and m_epath_length with m_best_epath.
1142         (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
1143         (saved_diagnostic::to_json): Update "path_length" to be optional.
1144         (saved_diagnostic::calc_best_epath): New, based on
1145         dedupe_winners::add and parts of dedupe_key::dedupe_key.
1146         (saved_diagnostic::get_epath_length): New.
1147         (saved_diagnostic::add_duplicate): New.
1148         (dedupe_key::dedupe_key): Drop epath param.  Move invocation of
1149         stmt_finder to saved_diagnostic::calc_best_epath.
1150         (class dedupe_candidate): Delete.
1151         (class dedupe_hash_map_traits): Update to use saved_diagnotic *
1152         rather than dedupe_candidate * as the value_type/compare_type.
1153         (dedupe_winners::~dedupe_winners): Don't delete the values.
1154         (dedupe_winners::add): Convert param from shortest_exploded_paths to
1155         epath_finder.  Drop "eg" param.  Drop dedupe_candidate, moving
1156         path generation and feasiblity checking to
1157         epath_finder::get_best_epath.  Update winner-selection for move
1158         of epaths from dedupe_candidate to saved_diagnostic.
1159         (dedupe_winners::emit_best):  Update for removal of class
1160         dedupe_candidate.
1161         (dedupe_winners::map_t): Update to use saved_diagnotic * rather
1162         than dedupe_candidate * as the value_type/compare_type.
1163         (diagnostic_manager::emit_saved_diagnostics): Move
1164         shortest_exploded_paths instance into epath_finder and pass that
1165         around instead.
1166         (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
1167         and num_dupes params, instead getting these from the
1168         saved_diagnostic.  Use correct location in inform_n call.
1169         * diagnostic-manager.h (class epath_finder): New forward decl.
1170         (saved_diagnostic::status): Drop enum.
1171         (saved_diagnostic::set_feasible): Drop.
1172         (saved_diagnostic::set_infeasible): Drop.
1173         (saved_diagnostic::get_status): Drop.
1174         (saved_diagnostic::calc_best_epath): New decl.
1175         (saved_diagnostic::get_best_epath): New decl.
1176         (saved_diagnostic::get_epath_length): New decl.
1177         (saved_diagnostic::set_epath_length): Drop.
1178         (saved_diagnostic::get_epath_length): Drop inline implementation.
1179         (saved_diagnostic::add_duplicate): New.
1180         (saved_diagnostic::get_num_dupes): New.
1181         (saved_diagnostic::m_d): Document ownership.
1182         (saved_diagnostic::m_trailing_eedge): Make const.
1183         (saved_diagnostic::m_status): Drop field.
1184         (saved_diagnostic::m_epath_length): Drop field.
1185         (saved_diagnostic::m_best_epath): New field.
1186         (saved_diagnostic::m_problem): Document ownership.
1187         (saved_diagnostic::m_duplicates): New field.
1188         (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
1189         stmt, and num_dupes.
1190         * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
1191         Update for changes to saved_diagnostic class.
1192         * exploded-graph.h (exploded_path::feasible_p): Drop unused
1193         overloaded decl.
1194
1195 2021-02-25  David Malcolm  <dmalcolm@redhat.com>
1196
1197         PR analyzer/99193
1198         * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
1199         * region-model.cc (region_model::on_call_pre): Call it.
1200         * region-model.h (region_model::impl_call_realloc): New decl.
1201         * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
1202         (malloc_state_machine::m_realloc): New field.
1203         (use_after_free::describe_state_change): Add case for
1204         WORDING_REALLOCATED.
1205         (use_after_free::describe_final_event): Likewise.
1206         (malloc_state_machine::malloc_state_machine): Initialize
1207         m_realloc.
1208         (malloc_state_machine::on_stmt): Handle realloc by calling...
1209         (malloc_state_machine::on_realloc_call): New.
1210
1211 2021-02-22  David Malcolm  <dmalcolm@redhat.com>
1212
1213         PR analyzer/99196
1214         * engine.cc (exploded_node::on_stmt): Provide terminate_path
1215         flag as a way for on_call_pre to terminate the current analysis
1216         path.
1217         * region-model-impl-calls.cc (call_details::num_args): New.
1218         (region_model::impl_call_error): New.
1219         * region-model.cc (region_model::on_call_pre): Add param
1220         "out_terminate_path".  Handle "error" and "error_at_line".
1221         * region-model.h (call_details::num_args): New decl.
1222         (region_model::on_call_pre): Add param "out_terminate_path".
1223         (region_model::impl_call_error): New decl.
1224
1225 2021-02-17  David Malcolm  <dmalcolm@redhat.com>
1226
1227         PR analyzer/98969
1228         * constraint-manager.cc (dead_svalue_purger::should_purge_p):
1229         Update for change to svalue::live_p.
1230         * program-state.cc (sm_state_map::on_liveness_change): Likewise.
1231         (program_state::detect_leaks): Likewise.
1232         * region-model-reachability.cc (reachable_regions::init_cluster):
1233         When dealing with a symbolic region, if the underlying pointer is
1234         implicitly live, add the region to the reachable regions.
1235         * region-model.cc (region_model::compare_initial_and_pointer):
1236         Move logic for detecting initial values of params to
1237         initial_svalue::initial_value_of_param_p.
1238         * svalue.cc (svalue::live_p): Convert "live_svalues" from a
1239         reference to a pointer; support it being NULL.
1240         (svalue::implicitly_live_p): Convert first param from a
1241         refererence to a pointer.
1242         (region_svalue::implicitly_live_p): Likewise.
1243         (constant_svalue::implicitly_live_p): Likewise.
1244         (initial_svalue::implicitly_live_p): Likewise.  Treat the initial
1245         values of params for the top level frame as still live.
1246         (initial_svalue::initial_value_of_param_p): New function, taken
1247         from a test in region_model::compare_initial_and_pointer.
1248         (unaryop_svalue::implicitly_live_p): Convert first param from a
1249         refererence to a pointer.
1250         (binop_svalue::implicitly_live_p): Likewise.
1251         (sub_svalue::implicitly_live_p): Likewise.
1252         (unmergeable_svalue::implicitly_live_p): Likewise.
1253         * svalue.h (svalue::live_p): Likewise.
1254         (svalue::implicitly_live_p): Likewise.
1255         (region_svalue::implicitly_live_p): Likewise.
1256         (constant_svalue::implicitly_live_p): Likewise.
1257         (initial_svalue::implicitly_live_p): Likewise.
1258         (initial_svalue::initial_value_of_param_p): New decl.
1259         (unaryop_svalue::implicitly_live_p): Convert first param from a
1260         refererence to a pointer.
1261         (binop_svalue::implicitly_live_p): Likewise.
1262         (sub_svalue::implicitly_live_p): Likewise.
1263         (unmergeable_svalue::implicitly_live_p): Likewise.
1264
1265 2021-02-12  David Malcolm  <dmalcolm@redhat.com>
1266
1267         PR analyzer/98969
1268         * engine.cc (readability): Add names for the various arbitrary
1269         values.  Handle NOP_EXPR and INTEGER_CST.
1270         (readability_comparator): Combine the readability tests for
1271         tree and stack depth, rather than performing them sequentially.
1272         (impl_region_model_context::on_state_leak): Strip off top-level
1273         casts.
1274         * region-model.cc (region_model::get_representative_path_var): Add
1275         type-checking, moving the bulk of the implementation to...
1276         (region_model::get_representative_path_var_1): ...here.  Respect
1277         types in casts by recursing and re-adding the cast, rather than
1278         merely stripping them off.  Use the correct type when handling
1279         region_svalue.
1280         (region_model::get_representative_tree): Strip off any top-level
1281         cast.
1282         (region_model::get_representative_path_var): Add type-checking,
1283         moving the bulk of the implementation to...
1284         (region_model::get_representative_path_var_1): ...here.
1285         * region-model.h (region_model::get_representative_path_var_1):
1286         New decl
1287         (region_model::get_representative_path_var_1): New decl.
1288         * store.cc (append_pathvar_with_type): New.
1289         (binding_cluster::get_representative_path_vars): Cast path_vars
1290         to the correct type when adding them to *OUT_PVS.
1291
1292 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
1293
1294         PR analyzer/98575
1295         * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
1296         variants.
1297
1298 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
1299
1300         PR analyzer/98575
1301         * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
1302         as having escaped.
1303
1304 2021-02-02  David Malcolm  <dmalcolm@redhat.com>
1305
1306         PR analyzer/93355
1307         PR analyzer/96374
1308         * engine.cc (toplevel_function_p): Simplify so that
1309         we only reject functions with a "__analyzer_" prefix.
1310         (add_any_callbacks): Delete.
1311         (exploded_graph::build_initial_worklist): Update for
1312         dropped param of toplevel_function_p.
1313         (exploded_graph::build_initial_worklist): Don't bother
1314         looking for callbacks that are reachable from global
1315         initializers.
1316
1317 2021-02-01  David Malcolm  <dmalcolm@redhat.com>
1318
1319         PR analyzer/98918
1320         * region-model-manager.cc
1321         (region_model_manager::get_or_create_initial_value):
1322         Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
1323         (region_model_manager::get_field_region): Fold the value
1324         of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
1325
1326 2021-01-29  David Malcolm  <dmalcolm@redhat.com>
1327
1328         * checker-path.cc (event_kind_to_string): Handle
1329         EK_START_CONSOLIDATED_CFG_EDGES and
1330         EK_END_CONSOLIDATED_CFG_EDGES.
1331         (start_consolidated_cfg_edges_event::get_desc): New.
1332         (checker_path::cfg_edge_pair_at_p): New.
1333         * checker-path.h (enum event_kind): Add
1334         EK_START_CONSOLIDATED_CFG_EDGES and
1335         EK_END_CONSOLIDATED_CFG_EDGES.
1336         (class start_consolidated_cfg_edges_event): New class.
1337         (class end_consolidated_cfg_edges_event): New class.
1338         (checker_path::delete_events): New.
1339         (checker_path::replace_event): New.
1340         (checker_path::cfg_edge_pair_at_p): New decl.
1341         * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
1342         consolidate_conditions.
1343         (same_line_as_p): New.
1344         (diagnostic_manager::consolidate_conditions): New.
1345         * diagnostic-manager.h
1346         (diagnostic_manager::consolidate_conditions): New decl.
1347
1348 2021-01-18  David Malcolm  <dmalcolm@redhat.com>
1349
1350         * analyzer.h (is_std_named_call_p): New decl.
1351         * diagnostic-manager.cc (path_builder::get_sm): New.
1352         (state_change_event_creator::state_change_event_creator): Add "pb"
1353         param.
1354         (state_change_event_creator::on_global_state_change): Don't consider
1355         state changes affecting other state_machines.
1356         (state_change_event_creator::on_state_change): Likewise.
1357         (state_change_event_creator::m_pb): New field.
1358         (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
1359         ctor.
1360         * region-model-impl-calls.cc
1361         (region_model::impl_deallocation_call): New.
1362         * region-model.cc: Include "attribs.h".
1363         (region_model::on_call_post): Handle fndecls referenced by
1364         __attribute__((deallocated_by(FOO))).
1365         * region-model.h (region_model::impl_deallocation_call): New decl.
1366         * sm-malloc.cc: Include "stringpool.h" and "attribs.h".  Add
1367         leading comment.
1368         (class api): Delete.
1369         (enum resource_state): Update comment for change from api to
1370         deallocator and deallocator_set.
1371         (allocation_state::allocation_state): Drop api param.  Add
1372         "deallocators" and "deallocator".
1373         (allocation_state::m_api): Drop field in favor of...
1374         (allocation_state::m_deallocators): New field.
1375         (allocation_state::m_deallocator): New field.
1376         (enum wording): Add WORDING_DEALLOCATED.
1377         (struct deallocator): New.
1378         (struct standard_deallocator): New.
1379         (struct custom_deallocator): New.
1380         (struct deallocator_set): New.
1381         (struct custom_deallocator_set): New.
1382         (struct standard_deallocator_set): New.
1383         (struct deallocator_set_map_traits): New.
1384         (malloc_state_machine::m_malloc): Drop field
1385         (malloc_state_machine::m_scalar_new): Likewise.
1386         (malloc_state_machine::m_vector_new): Likewise.
1387         (malloc_state_machine::m_free): New field
1388         (malloc_state_machine::m_scalar_delete): Likewise.
1389         (malloc_state_machine::m_vector_delete): Likewise.
1390         (malloc_state_machine::deallocator_map_t): New typedef.
1391         (malloc_state_machine::m_deallocator_map): New field.
1392         (malloc_state_machine::deallocator_set_cache_t): New typedef.
1393         (malloc_state_machine::m_custom_deallocator_set_cache): New field.
1394         (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
1395         (malloc_state_machine::m_custom_deallocator_set_map): New field.
1396         (malloc_state_machine::m_dynamic_sets): New field.
1397         (malloc_state_machine::m_dynamic_deallocators): New field.
1398         (api::api): Delete.
1399         (deallocator::deallocator): New ctor.
1400         (deallocator::hash): New.
1401         (deallocator::dump_to_pp): New.
1402         (deallocator::cmp): New.
1403         (deallocator::cmp_ptr_ptr): New.
1404         (standard_deallocator::standard_deallocator): New ctor.
1405         (deallocator_set::deallocator_set): New ctor.
1406         (deallocator_set::dump): New.
1407         (custom_deallocator_set::custom_deallocator_set): New ctor.
1408         (custom_deallocator_set::contains_p): New.
1409         (custom_deallocator_set::maybe_get_single): New.
1410         (custom_deallocator_set::dump_to_pp): New.
1411         (standard_deallocator_set::standard_deallocator_set): New ctor.
1412         (standard_deallocator_set::contains_p): New.
1413         (standard_deallocator_set::maybe_get_single): New.
1414         (standard_deallocator_set::dump_to_pp): New.
1415         (start_p): New.
1416         (class mismatching_deallocation): Update for conversion from api
1417         to deallocator_set and deallocator.
1418         (double_free::emit): Use %qs.
1419         (class use_after_free): Update for conversion from api to
1420         deallocator_set and deallocator.
1421         (malloc_leak::describe_state_change): Only emit "allocated here" on
1422         a start->nonnull transition, rather than on other transitions to
1423         nonnull.
1424         (allocation_state::dump_to_pp): Update for conversion from api to
1425         deallocator_set.
1426         (allocation_state::get_nonnull): Likewise.
1427         (malloc_state_machine::malloc_state_machine): Likewise.
1428         (malloc_state_machine::~malloc_state_machine): New.
1429         (malloc_state_machine::add_state): Update for conversion from api
1430         to deallocator_set.
1431         (malloc_state_machine::get_or_create_custom_deallocator_set): New.
1432         (malloc_state_machine::maybe_create_custom_deallocator_set): New.
1433         (malloc_state_machine::get_or_create_deallocator): New.
1434         (malloc_state_machine::on_stmt): Update for conversion from api
1435         to deallocator_set.  Handle "__attribute__((malloc(FOO)))", and
1436         the special attribute set on FOO.
1437         (malloc_state_machine::on_allocator_call): Update for conversion
1438         from api to deallocator_set.  Add "returns_nonnull" param and use
1439         it to affect which state to transition to.
1440         (malloc_state_machine::on_deallocator_call): Update for conversion
1441         from api to deallocator_set.
1442
1443 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
1444
1445         * engine.cc (strongly_connected_components::to_json): New.
1446         (worklist::to_json): New.
1447         (exploded_graph::to_json): JSON-ify the worklist.
1448         * exploded-graph.h (strongly_connected_components::to_json): New
1449         decl.
1450         (worklist::to_json): New decl.
1451         * store.cc (store::to_json): Fix comment.
1452         * supergraph.cc (supernode::to_json): Fix reference to
1453         "returning_call" in comment.  Add optional "fun" to JSON.
1454         (edge_kind_to_string): New.
1455         (superedge::to_json): Add "kind" to JSON.
1456
1457 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
1458
1459         PR analyzer/98679
1460         * analyzer.h (region_offset::operator==): Make const.
1461         * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
1462         * store.h (binding_cluster::for_each_value): Likewise.
1463         (binding_cluster::for_each_binding): Likewise.
1464
1465 2021-01-12  David Malcolm  <dmalcolm@redhat.com>
1466
1467         PR analyzer/98628
1468         * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
1469         dereferenced unknown pointers as having escaped.
1470
1471 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
1472
1473         PR analyzer/98580
1474         * region.cc (decl_region::get_svalue_for_initializer): Gracefully
1475         handle when LTO writes out DECL_INITIAL as error_mark_node.
1476
1477 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
1478
1479         PR analyzer/97074
1480         * store.cc (binding_cluster::can_merge_p): Add "out_store" param
1481         and pass to calls to binding_cluster::make_unknown_relative_to.
1482         (binding_cluster::make_unknown_relative_to): Add "out_store"
1483         param.  Use it to mark base regions that are pointed to by
1484         pointers that become unknown as having escaped.
1485         (store::can_merge_p): Pass out_store to
1486         binding_cluster::can_merge_p.
1487         * store.h (binding_cluster::can_merge_p): Add "out_store" param.
1488         (binding_cluster::make_unknown_relative_to): Likewise.
1489         * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
1490         * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
1491
1492 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
1493
1494         PR analyzer/98564
1495         * engine.cc (exploded_path::feasible_p): Add missing call to
1496         bitmap_clear.
1497
1498 2021-01-06  David Malcolm  <dmalcolm@redhat.com>
1499
1500         PR analyzer/97072
1501         * region-model-reachability.cc (reachable_regions::init_cluster):
1502         Convert symbolic region handling to a switch statement.  Add cases
1503         to handle SK_UNKNOWN and SK_CONJURED.
1504
1505 2021-01-05  David Malcolm  <dmalcolm@redhat.com>
1506
1507         PR analyzer/98293
1508         * store.cc (binding_map::apply_ctor_to_region): When "index" is
1509         NULL, iterate through the fields for RECORD_TYPEs, rather than
1510         creating an INTEGER_CST index.
1511
1512 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
1513
1514         * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
1515         declaration of sorry_no_analyzer; include "tree.h" and
1516         "function.h" as these are needed by it.
1517
1518 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
1519
1520         * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
1521         (sorry_no_analyzer): New.
1522         * analyzer.h (class state_machine): New forward decl.
1523         (class logger): New forward decl.
1524         (class plugin_analyzer_init_iface): New.
1525         (sorry_no_analyzer): New decl.
1526         * checker-path.cc (checker_path::fixup_locations): New.
1527         * checker-path.h (checker_event::set_location): New.
1528         (checker_path::fixup_locations): New decl.
1529         * diagnostic-manager.cc
1530         (diagnostic_manager::emit_saved_diagnostic): Call
1531         checker_path::fixup_locations, and call fixup_location
1532         on the primary location.
1533         * engine.cc: Include "plugin.h".
1534         (class plugin_analyzer_init_impl): New.
1535         (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
1536         * pending-diagnostic.h (pending_diagnostic::fixup_location): New
1537         vfunc.
1538
1539 2020-11-18  David Malcolm  <dmalcolm@redhat.com>
1540
1541         PR analyzer/97893
1542         * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
1543         CWE-690, as this isn't due to an unchecked return value.
1544         (null_arg::emit): Likewise.
1545
1546 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
1547
1548         * checker-path.h (checker_event::get_id_ptr): New.
1549         * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
1550         param and use it to initialize new field "m_sd".
1551         (path_builder::get_pending_diagnostic): New.
1552         (path_builder::m_sd): New field.
1553         (diagnostic_manager::emit_saved_diagnostic): Pass sd to
1554         path_builder ctor.
1555         (diagnostic_manager::add_events_for_superedge): Call new
1556         maybe_add_custom_events_for_superedge vfunc.
1557         * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
1558         param and use it to initialize new field "m_setjmp_point".
1559         Initialize new field "m_stack_pop_event".
1560         (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
1561         implementation.
1562         (stale_jmp_buf::describe_final_event): New vfunc implementation.
1563         (stale_jmp_buf::m_setjmp_point): New field.
1564         (stale_jmp_buf::m_stack_pop_event): New field.
1565         (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
1566         ctor.
1567         * pending-diagnostic.h
1568         (pending_diagnostic::maybe_add_custom_events_for_superedge): New
1569         vfunc.
1570
1571 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
1572
1573         PR tree-optimization/97424
1574         * analyzer.opt (Wanalyzer-shift-count-negative): New.
1575         (Wanalyzer-shift-count-overflow): New.
1576         * region-model.cc (class shift_count_negative_diagnostic): New.
1577         (class shift_count_overflow_diagnostic): New.
1578         (region_model::get_gassign_result): Complain about shift counts that
1579         are negative or are >= the operand's type's width.
1580
1581 2020-11-10  Martin Liska  <mliska@suse.cz>
1582
1583         * constraint-manager.cc (constraint_manager::merge): Remove
1584         unused code.
1585         * constraint-manager.h: Likewise.
1586         * program-state.cc (sm_state_map::sm_state_map): Likewise.
1587         (program_state::program_state): Likewise.
1588         (test_sm_state_map): Likewise.
1589         * program-state.h: Likewise.
1590         * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
1591         * region-model-reachability.h: Likewise.
1592         * region-model.cc (region_model::handle_unrecognized_call): Likewise.
1593         (region_model::get_reachable_svalues): Likewise.
1594         (region_model::can_merge_with_p): Likewise.
1595
1596 2020-11-05  David Malcolm  <dmalcolm@redhat.com>
1597
1598         PR analyzer/97668
1599         * svalue.cc (cmp_cst): Handle COMPLEX_CST.
1600
1601 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
1602
1603         * program-state.cc (sm_state_map::on_liveness_change): Sort the
1604         leaking svalues before calling on_state_leak.
1605         (program_state::detect_leaks): Likewise when calling
1606         on_svalue_leak.
1607         * region-model-reachability.cc
1608         (reachable_regions::mark_escaped_clusters): Likewise when
1609         calling on_escaped_function.
1610
1611 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
1612
1613         PR analyzer/97608
1614         * region-model-reachability.cc (reachable_regions::handle_sval):
1615         Operands of reachable reversible operations are reachable.
1616
1617 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
1618
1619         * analyzer.h (class state_machine): New forward decl.
1620         (class logger): Likewise.
1621         (class visitor): Likewise.
1622         * complexity.cc: New file, taken from svalue.cc.
1623         * complexity.h: New file, taken from region-model.h.
1624         * region-model.h: Include "analyzer/svalue.h" and
1625         "analyzer/region.h".  Move struct complexity to complexity.h.
1626         Move svalue, its subclasses and supporting decls to svalue.h.
1627         Move region, its subclasses and supporting decls to region.h.
1628         * region.cc: Include "analyzer/region.h".
1629         (symbolic_region::symbolic_region): Move here from region-model.h.
1630         * region.h: New file, based on material from region-model.h.
1631         * svalue.cc: Include "analyzer/svalue.h".
1632         (complexity::complexity): Move to complexity.cc.
1633         (complexity::from_pair): Likewise.
1634         * svalue.h: New file, based on material from region-model.h.
1635
1636 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
1637
1638         * program-state.cc (sm_state_map::print): Guard the printing of
1639         the origin pointer with !flag_dump_noaddr.
1640         * region.cc (string_region::dump_to_pp): Likewise for
1641         m_string_cst.
1642
1643 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
1644
1645         PR analyzer/97568
1646         * region-model.cc (region_model::get_initial_value_for_global):
1647         Move check that !DECL_EXTERNAL from here to...
1648         * region.cc (decl_region::get_svalue_for_initializer): ...here,
1649         using it to reject zero initialization.
1650
1651 2020-10-27  Markus Böck  <markus.boeck02@gmail.com>
1652
1653         PR analyzer/96608
1654         * store.h (hash): Cast to intptr_t instead of long
1655
1656 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
1657
1658         * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
1659         (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
1660         (equiv_class_cmp): Eliminate pointer comparison.
1661         * diagnostic-manager.cc (dedupe_key::comparator): If they are at
1662         the same location, also compare epath ength and pending_diagnostic
1663         kind.
1664         * engine.cc (readability_comparator): If two path_vars have the
1665         same readability, then impose an arbitrary ordering on them.
1666         (worklist::key_t::cmp): If two points have the same plan ordering,
1667         continue the comparison.  Call sm_state_map::cmp rather than
1668         comparing hash values.
1669         * program-state.cc (sm_state_map::entry_t::cmp): New.
1670         (sm_state_map::cmp): New.
1671         * program-state.h (sm_state_map::entry_t::cmp): New decl.
1672         (sm_state_map::elements): New.
1673         (sm_state_map::cmp): New.
1674
1675 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
1676
1677         * engine.cc (setjmp_record::cmp): New.
1678         (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
1679         name.
1680         (supernode_cluster::cmp_ptr_ptr): New.
1681         (function_call_string_cluster::dump_dot): Avoid embedding pointer
1682         in cluster name.  Sort m_map when dumping child clusters.
1683         (function_call_string_cluster::cmp_ptr_ptr): New.
1684         (root_cluster::dump_dot): Sort m_map when dumping child clusters.
1685         * program-point.cc (function_point::cmp): New.
1686         (function_point::cmp_ptr): New.
1687         * program-point.h (function_point::cmp): New decl.
1688         (function_point::cmp_ptr): New decl.
1689         * program-state.cc (sm_state_map::print): Sort the values.  Guard
1690         the printing of pointers with !flag_dump_noaddr.
1691         (program_state::prune_for_point): Sort the regions.
1692         (log_set_of_svalues): Sort the values.  Guard the printing of
1693         pointers with !flag_dump_noaddr.
1694         * region-model-manager.cc (log_uniq_map): Sort the values.
1695         * region-model-reachability.cc (dump_set): New function template.
1696         (reachable_regions::dump_to_pp): Use it.
1697         * region-model.h (svalue::cmp_ptr): New decl.
1698         (svalue::cmp_ptr_ptr): New decl.
1699         (setjmp_record::cmp): New decl.
1700         (placeholder_svalue::get_name): New accessor.
1701         (widening_svalue::get_point): New accessor.
1702         (compound_svalue::get_map): New accessor.
1703         (conjured_svalue::get_stmt): New accessor.
1704         (conjured_svalue::get_id_region): New accessor.
1705         (region::cmp_ptrs): Rename to...
1706         (region::cmp_ptr_ptr): ...this.
1707         * region.cc (region::cmp_ptrs): Rename to...
1708         (region::cmp_ptr_ptr): ...this.
1709         * state-purge.cc
1710         (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
1711         m_points_needing_name when dumping.
1712         * store.cc (concrete_binding::cmp_ptr_ptr): New.
1713         (symbolic_binding::cmp_ptr_ptr): New.
1714         (binding_map::cmp): New.
1715         (get_sorted_parent_regions): Update for renaming of
1716         region::cmp_ptrs to region::cmp_ptr_ptr.
1717         (store::dump_to_pp): Likewise.
1718         (store::to_json): Likewise.
1719         (store::can_merge_p): Sort the base regions before considering
1720         them.
1721         * store.h (concrete_binding::cmp_ptr_ptr): New decl.
1722         (symbolic_binding::cmp_ptr_ptr): New decl.
1723         (binding_map::cmp): New decl.
1724         * supergraph.cc (supergraph::supergraph): Assign UIDs to the
1725         gimple stmts.
1726         * svalue.cc (cmp_cst): New.
1727         (svalue::cmp_ptr): New.
1728         (svalue::cmp_ptr_ptr): New.
1729
1730 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
1731
1732         * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
1733         when imposing param_analyzer_max_enodes_per_program_point limit.
1734
1735 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
1736
1737         * region-model.cc (region_model::get_representative_path_var):
1738         Implement case RK_LABEL.
1739         * region-model.h (label_region::get_label): New accessor.
1740
1741 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
1742
1743         PR analyzer/97514
1744         * engine.cc (exploded_graph::add_function_entry): Handle failure
1745         to create an enode, rather than asserting.
1746
1747 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
1748
1749         PR analyzer/97489
1750         * engine.cc (exploded_graph::add_function_entry): Assert that we
1751         have a function body.
1752         (exploded_graph::on_escaped_function): Reject fndecls that don't
1753         have a function body.
1754
1755 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
1756
1757         PR analyzer/93388
1758         * region-model.cc (region_model::get_initial_value_for_global):
1759         Fall back to returning an initial_svalue if
1760         decl_region::get_svalue_for_initializer fails.
1761         * region.cc (decl_region::get_svalue_for_initializer): Don't
1762         attempt to create a compound_svalue if the region has an unknown
1763         size.
1764
1765 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
1766
1767         PR analyzer/93723
1768         * store.cc (binding_map::apply_ctor_to_region): Remove redundant
1769         assertion.
1770
1771 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
1772
1773         PR analyzer/97258
1774         * engine.cc (impl_region_model_context::on_escaped_function): New
1775         vfunc.
1776         (exploded_graph::add_function_entry): Use m_functions_with_enodes
1777         to implement idempotency.
1778         (add_any_callbacks): New.
1779         (exploded_graph::build_initial_worklist): Use the above to find
1780         callbacks that are reachable from global initializers.
1781         (exploded_graph::on_escaped_function): New.
1782         * exploded-graph.h
1783         (impl_region_model_context::on_escaped_function): New decl.
1784         (exploded_graph::on_escaped_function): New decl.
1785         (exploded_graph::m_functions_with_enodes): New field.
1786         * region-model-reachability.cc
1787         (reachable_regions::reachable_regions): Replace "store" param with
1788         "model" param; use it to initialize m_model.
1789         (reachable_regions::add): When getting the svalue for the region,
1790         call get_store_value on the model rather than using an initial
1791         value.
1792         (reachable_regions::mark_escaped_clusters): Add ctxt param and
1793         use it to call on_escaped_function when a function_region escapes.
1794         * region-model-reachability.h
1795         (reachable_regions::reachable_regions): Replace "store" param with
1796         "model" param.
1797         (reachable_regions::mark_escaped_clusters): Add ctxt param.
1798         (reachable_regions::m_model): New field.
1799         * region-model.cc (region_model::handle_unrecognized_call): Update
1800         for change in reachable_regions ctor.
1801         (region_model::handle_unrecognized_call): Pass ctxt to
1802         mark_escaped_clusters.
1803         (region_model::get_reachable_svalues): Update for change in
1804         reachable_regions ctor.
1805         (region_model::get_initial_value_for_global): Read-only variables
1806         keep their initial values.
1807         * region-model.h (region_model_context::on_escaped_function): New
1808         vfunc.
1809         (noop_region_model_context::on_escaped_function): New.
1810
1811 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
1812
1813         * analyzer.opt (Wanalyzer-write-to-const): New.
1814         (Wanalyzer-write-to-string-literal): New.
1815         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
1816         Call check_for_writable_region.
1817         (region_model::impl_call_memset): Likewise.
1818         (region_model::impl_call_strcpy): Likewise.
1819         * region-model.cc (class write_to_const_diagnostic): New.
1820         (class write_to_string_literal_diagnostic): New.
1821         (region_model::check_for_writable_region): New.
1822         (region_model::set_value): Call check_for_writable_region.
1823         * region-model.h (region_model::check_for_writable_region): New
1824         decl.
1825
1826 2020-10-07  David Malcolm  <dmalcolm@redhat.com>
1827
1828         PR analyzer/97116
1829         * sm-malloc.cc (method_p): New.
1830         (describe_argument_index): New.
1831         (inform_nonnull_attribute): Use describe_argument_index.
1832         (possible_null_arg::describe_final_event): Likewise.
1833         (null_arg::describe_final_event): Likewise.
1834
1835 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
1836
1837         PR analyzer/95188
1838         * engine.cc (stmt_requires_new_enode_p): Split enodes before
1839         "signal" calls.
1840
1841 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
1842
1843         * constraint-manager.cc
1844         (constraint_manager::add_constraint_internal): Whitespace fixes.
1845         Silence -Wsign-compare warning.
1846         * engine.cc (maybe_process_run_of_before_supernode_enodes):
1847         Silence -Wsign-compare warning.
1848
1849 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
1850
1851         * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
1852         redundant "virtual".  Add FINAL OVERRIDE.
1853         (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
1854         (compound_svalue::dyn_cast_compound_svalue): Likewise.
1855         (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
1856
1857 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
1858
1859         * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
1860         Remove unused field.
1861
1862 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
1863
1864         PR analyzer/97233
1865         * analyzer.cc (is_longjmp_call_p): Require the initial argument
1866         to be a pointer.
1867         * engine.cc (exploded_node::on_longjmp): Likewise.
1868
1869 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
1870
1871         * program-state.cc (sm_state_map::print): Update check
1872         for m_global_state being the start state.
1873
1874 2020-09-26  David Malcolm  <dmalcolm@redhat.com>
1875
1876         PR analyzer/96646
1877         PR analyzer/96841
1878         * region-model.cc (region_model::get_representative_path_var):
1879         When handling offset_region, wrap the MEM_REF's first argument in
1880         an ADDR_EXPR of pointer type, rather than simply using the tree
1881         for the parent region.  Require the MEM_REF's second argument to
1882         be an integer constant.
1883
1884 2020-09-24  David Malcolm  <dmalcolm@redhat.com>
1885
1886         * analyzer.h (struct rejected_constraint): New decl.
1887         * analyzer.opt (fanalyzer-feasibility): New option.
1888         * diagnostic-manager.cc (path_builder::path_builder): Add
1889         "problem" param and use it to initialize new field.
1890         (path_builder::get_feasibility_problem): New accessor.
1891         (path_builder::m_feasibility_problem): New field.
1892         (dedupe_winners::add): Remove inversion of logic in "if" clause,
1893         swapping if/else suites.  In the !feasible_p suite, inspect
1894         flag_analyzer_feasibility and add code to handle when this
1895         is off, accepting the infeasible path, but recording the
1896         feasibility_problem.
1897         (diagnostic_manager::emit_saved_diagnostic): Pass the
1898         feasibility_problem to the path_builder.
1899         (diagnostic_manager::add_events_for_eedge): If we have
1900         a feasibility_problem at this edge, use it to add a custom event.
1901         * engine.cc (exploded_path::feasible_p): Pass a
1902         rejected_constraint ** to model.maybe_update_for_edge and transfer
1903         ownership of any created instance to any feasibility_problem.
1904         (feasibility_problem::dump_to_pp): New.
1905         * exploded-graph.h (feasibility_problem::feasibility_problem):
1906         Drop "model" param; add rejected_constraint * param.
1907         (feasibility_problem::~feasibility_problem): New.
1908         (feasibility_problem::dump_to_pp): New decl.
1909         (feasibility_problem::m_model): Drop field.
1910         (feasibility_problem::m_rc): New field.
1911         * program-point.cc (function_point::get_location): Handle
1912         PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
1913         * program-state.cc (program_state::on_edge): Pass NULL to new
1914         param of region_model::maybe_update_for_edge.
1915         * region-model.cc (region_model::add_constraint): New overload
1916         adding a rejected_constraint ** param.
1917         (region_model::maybe_update_for_edge): Add rejected_constraint **
1918         param and pass it to the various apply_constraints_for_ calls.
1919         (region_model::apply_constraints_for_gcond): Add
1920         rejected_constraint ** param and pass it to add_constraint calls.
1921         (region_model::apply_constraints_for_gswitch): Likewise.
1922         (region_model::apply_constraints_for_exception): Likewise.
1923         (rejected_constraint::dump_to_pp): New.
1924         * region-model.h (region_model::maybe_update_for_edge):
1925         Add rejected_constraint ** param.
1926         (region_model::add_constraint): New overload adding a
1927         rejected_constraint ** param.
1928         (region_model::apply_constraints_for_gcond): Add
1929         rejected_constraint ** param.
1930         (region_model::apply_constraints_for_gswitch): Likewise.
1931         (region_model::apply_constraints_for_exception): Likewise.
1932         (struct rejected_constraint): New.
1933
1934 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
1935
1936         PR analyzer/97178
1937         * engine.cc (impl_run_checkers): Update for change to ext_state
1938         ctor.
1939         * program-state.cc (selftest::test_sm_state_map): Pass an engine
1940         instance to ext_state ctor.
1941         (selftest::test_program_state_1): Likewise.
1942         (selftest::test_program_state_2): Likewise.
1943         (selftest::test_program_state_merging): Likewise.
1944         (selftest::test_program_state_merging_2): Likewise.
1945         * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
1946         default value for "eng" param.
1947
1948 2020-09-23  Tobias Burnus  <tobias@codesourcery.com>
1949
1950         * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
1951         by '#if __GNUC__ >= 10'
1952         * analyzer.h: Likewise.
1953         * call-string.cc: Likewise.
1954
1955 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
1956
1957         * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
1958         with switch.
1959
1960 2020-09-22  David Malcolm  <dmalcolm@redhat.com>
1961
1962         * analysis-plan.cc: Include "json.h".
1963         * analyzer.opt (fdump-analyzer-json): New.
1964         * call-string.cc: Include "json.h".
1965         (call_string::to_json): New.
1966         * call-string.h (call_string::to_json): New decl.
1967         * checker-path.cc: Include "json.h".
1968         * constraint-manager.cc: Include "json.h".
1969         (equiv_class::to_json): New.
1970         (constraint::to_json): New.
1971         (constraint_manager::to_json): New.
1972         * constraint-manager.h (equiv_class::to_json): New decl.
1973         (constraint::to_json): New decl.
1974         (constraint_manager::to_json): New decl.
1975         * diagnostic-manager.cc: Include "json.h".
1976         (saved_diagnostic::to_json): New.
1977         (diagnostic_manager::to_json): New.
1978         * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
1979         (diagnostic_manager::to_json): New decl.
1980         * engine.cc: Include "json.h", <zlib.h>.
1981         (exploded_node::status_to_str): New.
1982         (exploded_node::to_json): New.
1983         (exploded_edge::to_json): New.
1984         (exploded_graph::to_json): New.
1985         (dump_analyzer_json): New.
1986         (impl_run_checkers): Call it.
1987         * exploded-graph.h (exploded_node::status_to_str): New decl.
1988         (exploded_node::to_json): New.
1989         (exploded_edge::to_json): New.
1990         (exploded_graph::to_json): New.
1991         * pending-diagnostic.cc: Include "json.h".
1992         * program-point.cc: Include "json.h".
1993         (program_point::to_json): New.
1994         * program-point.h (program_point::to_json): New decl.
1995         * program-state.cc: Include "json.h".
1996         (extrinsic_state::to_json): New.
1997         (sm_state_map::to_json): New.
1998         (program_state::to_json): New.
1999         * program-state.h (extrinsic_state::to_json): New decl.
2000         (sm_state_map::to_json): New decl.
2001         (program_state::to_json): New decl.
2002         * region-model-impl-calls.cc: Include "json.h".
2003         * region-model-manager.cc: Include "json.h".
2004         * region-model-reachability.cc: Include "json.h".
2005         * region-model.cc: Include "json.h".
2006         * region-model.h (svalue::to_json): New decl.
2007         (region::to_json): New decl.
2008         * region.cc: Include "json.h".
2009         (region::to_json: New.
2010         * sm-file.cc: Include "json.h".
2011         * sm-malloc.cc: Include "json.h".
2012         * sm-pattern-test.cc: Include "json.h".
2013         * sm-sensitive.cc: Include "json.h".
2014         * sm-signal.cc: Include "json.h".
2015         (signal_delivery_edge_info_t::to_json): New.
2016         * sm-taint.cc: Include "json.h".
2017         * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
2018         "json.h".
2019         (state_machine::state::to_json): New.
2020         (state_machine::to_json): New.
2021         * sm.h (state_machine::state::to_json): New.
2022         (state_machine::to_json): New.
2023         * state-purge.cc: Include "json.h".
2024         * store.cc: Include "json.h".
2025         (binding_key::get_desc): New.
2026         (binding_map::to_json): New.
2027         (binding_cluster::to_json): New.
2028         (store::to_json): New.
2029         * store.h (binding_key::get_desc): New decl.
2030         (binding_map::to_json): New decl.
2031         (binding_cluster::to_json): New decl.
2032         (store::to_json): New decl.
2033         * supergraph.cc: Include "json.h".
2034         (supergraph::to_json): New.
2035         (supernode::to_json): New.
2036         (superedge::to_json): New.
2037         * supergraph.h (supergraph::to_json): New decl.
2038         (supernode::to_json): New decl.
2039         (superedge::to_json): New decl.
2040         * svalue.cc: Include "json.h".
2041         (svalue::to_json): New.
2042
2043 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
2044
2045         PR analyzer/97130
2046         * region-model-impl-calls.cc (call_details::get_arg_type): New.
2047         * region-model.cc (region_model::on_call_pre): Check that the
2048         initial arg is a pointer before calling impl_call_memset and
2049         impl_call_strlen.
2050         * region-model.h (call_details::get_arg_type): New decl.
2051
2052 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
2053
2054         PR analyzer/93355
2055         * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
2056         the base region when considering pointers.  Treat pointers to
2057         decls as being non-heap.
2058
2059 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
2060
2061         * checker-path.cc (warning_event::get_desc): Handle global state
2062         changes.
2063
2064 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
2065
2066         * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
2067         strndup as being malloc-like allocators.
2068
2069 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2070
2071         * engine.cc (strongly_connected_components::strong_connect): Only
2072         consider intraprocedural edges when creating SCCs.
2073         (worklist::key_t::cmp): Add comment.  Treat call_string
2074         differences as more important than differences of program_point
2075         within a supernode.
2076
2077 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2078
2079         * engine.cc (supernode_cluster::dump_dot): Show the SCC id
2080         in the per-supernode clusters in FILENAME.eg.dot output.
2081         (exploded_graph_annotator::add_node_annotations):
2082         Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
2083         * exploded-graph.h (worklist::scc_id): New.
2084         (exploded_graph::get_scc_id): New.
2085
2086 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2087
2088         * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
2089         (exploded_graph::process_worklist): Call
2090         maybe_process_run_of_before_supernode_enodes.
2091         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
2092         New.
2093         (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
2094         * exploded-graph.h (enum exploded_node::status): Add
2095         STATUS_BULK_MERGED.
2096
2097 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2098
2099         * engine.cc
2100         (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
2101         Simplify by using program_point::get_next.
2102         * program-point.cc (program_point::get_next): New.
2103         * program-point.h (program_point::get_next): New decl.
2104
2105 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2106
2107         * engine.cc (exploded_graph::get_or_create_node): Show the
2108         program point when issuing -Wanalyzer-too-complex due to hitting
2109         the per-program-point limit.
2110
2111 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
2112
2113         * region-model.cc (region_model::on_call_pre): Treat getchar as
2114         having no side-effects.
2115
2116 2020-09-15  David Malcolm  <dmalcolm@redhat.com>
2117
2118         PR analyzer/96650
2119         * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
2120         assertion that add_constraint succeeded with an assertion that
2121         if it fails, -fanalyzer-transitivity is off.
2122
2123 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2124
2125         * analyzer.opt (-param=analyzer-max-constraints=): New param.
2126         * constraint-manager.cc
2127         (constraint_manager::add_constraint_internal): Silently reject
2128         attempts to add constraints when the above limit is reached.
2129
2130 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2131
2132         PR analyzer/96653
2133         * constraint-manager.cc
2134         (constraint_manager::get_or_add_equiv_class): Don't accumulate
2135         transitive closure of all constraints on constants.
2136
2137 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
2138
2139         PR analyzer/97029
2140         * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
2141         pointer.
2142         * region-model.cc (region_model::deref_rvalue): Assert that the
2143         svalue is of pointer type.
2144
2145 2020-09-11  David Malcolm  <dmalcolm@redhat.com>
2146
2147         PR analyzer/96798
2148         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
2149         New.
2150         (region_model::impl_call_strcpy): New.
2151         * region-model.cc (region_model::on_call_pre): Flag unhandled
2152         builtins that are non-pure as having unknown side-effects.
2153         Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
2154         BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
2155         BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
2156         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2157         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2158         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2159         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2160         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
2161         * region-model.h (region_model::impl_call_memcpy): New decl.
2162         (region_model::impl_call_strcpy): New decl.
2163
2164 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
2165
2166         PR analyzer/94355
2167         * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
2168         * region-model-impl-calls.cc
2169         (region_model::impl_call_operator_new): New.
2170         (region_model::impl_call_operator_delete): New.
2171         * region-model.cc (region_model::on_call_pre): Detect operator new
2172         and operator delete.
2173         (region_model::on_call_post): Likewise.
2174         (region_model::maybe_update_for_edge): Detect EH edges and call...
2175         (region_model::apply_constraints_for_exception): New function.
2176         * region-model.h (region_model::impl_call_operator_new): New decl.
2177         (region_model::impl_call_operator_delete): New decl.
2178         (region_model::apply_constraints_for_exception): New decl.
2179         * sm-malloc.cc (enum resource_state): New.
2180         (struct allocation_state): New state subclass.
2181         (enum wording): New.
2182         (struct api): New.
2183         (malloc_state_machine::custom_data_t): New typedef.
2184         (malloc_state_machine::add_state): New decl.
2185         (malloc_state_machine::m_unchecked)
2186         (malloc_state_machine::m_nonnull)
2187         (malloc_state_machine::m_freed): Delete these states in favor
2188         of...
2189         (malloc_state_machine::m_malloc)
2190         (malloc_state_machine::m_scalar_new)
2191         (malloc_state_machine::m_vector_new): ...this new api instances,
2192         which own their own versions of these states.
2193         (malloc_state_machine::on_allocator_call): New decl.
2194         (malloc_state_machine::on_deallocator_call): New decl.
2195         (api::api): New ctor.
2196         (dyn_cast_allocation_state): New.
2197         (as_a_allocation_state): New.
2198         (get_rs): New.
2199         (unchecked_p): New.
2200         (nonnull_p): New.
2201         (freed_p): New.
2202         (malloc_diagnostic::describe_state_change): Use unchecked_p and
2203         nonnull_p.
2204         (class mismatching_deallocation): New.
2205         (double_free::double_free): Add funcname param for initializing
2206         m_funcname.
2207         (double_free::emit): Use m_funcname in warning message rather
2208         than hardcoding "free".
2209         (double_free::describe_state_change): Likewise.  Use freed_p.
2210         (double_free::describe_call_with_state): Use freed_p.
2211         (double_free::describe_final_event): Use m_funcname in message
2212         rather than hardcoding "free".
2213         (double_free::m_funcname): New field.
2214         (possible_null::describe_state_change): Use unchecked_p.
2215         (possible_null::describe_return_of_state): Likewise.
2216         (use_after_free::use_after_free): Add param for initializing m_api.
2217         (use_after_free::emit): Use m_api->m_dealloc_funcname in message
2218         rather than hardcoding "free".
2219         (use_after_free::describe_state_change): Use freed_p.  Change the
2220         wording of the message based on the API.
2221         (use_after_free::describe_final_event): Use
2222         m_api->m_dealloc_funcname in message rather than hardcoding
2223         "free".  Change the wording of the message based on the API.
2224         (use_after_free::m_api): New field.
2225         (malloc_leak::describe_state_change): Use unchecked_p.  Update
2226         for renaming of m_malloc_event to m_alloc_event.
2227         (malloc_leak::describe_final_event): Update for renaming of
2228         m_malloc_event to m_alloc_event.
2229         (malloc_leak::m_malloc_event): Rename...
2230         (malloc_leak::m_alloc_event): ...to this.
2231         (free_of_non_heap::free_of_non_heap): Add param for initializing
2232         m_funcname.
2233         (free_of_non_heap::emit): Use m_funcname in message rather than
2234         hardcoding "free".
2235         (free_of_non_heap::describe_final_event): Likewise.
2236         (free_of_non_heap::m_funcname): New field.
2237         (allocation_state::dump_to_pp): New.
2238         (allocation_state::get_nonnull): New.
2239         (malloc_state_machine::malloc_state_machine): Update for changes
2240         to state fields and new api fields.
2241         (malloc_state_machine::add_state): New.
2242         (malloc_state_machine::on_stmt): Move malloc/calloc handling to
2243         on_allocator_call and call it, passing in the API pointer.
2244         Likewise for free, moving it to on_deallocator_call.  Handle calls
2245         to operator new and delete in an analogous way.  Use unchecked_p
2246         when testing for possibly-null-arg and possibly-null-deref, and
2247         transition to the non-null for the correct API.  Remove redundant
2248         node param from call to on_zero_assignment.  Use freed_p for
2249         use-after-free check, and pass in API.
2250         (malloc_state_machine::on_allocator_call): New, based on code in
2251         on_stmt.
2252         (malloc_state_machine::on_deallocator_call): Likewise.
2253         (malloc_state_machine::on_phi): Mark node param with
2254         ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
2255         (malloc_state_machine::on_condition): Mark node param with
2256         ATTRIBUTE_UNUSED.  Replace on_transition calls with get_state and
2257         set_next_state pairs, transitioning to the non-null state for the
2258         appropriate API.
2259         (malloc_state_machine::can_purge_p): Port to new state approach.
2260         (malloc_state_machine::on_zero_assignment): Replace on_transition
2261         calls with get_state and set_next_state pairs.  Drop redundant
2262         node param.
2263         * sm.h (state_machine::add_custom_state): New.
2264
2265 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
2266
2267         * diagnostic-manager.cc
2268         (null_assignment_sm_context::warn_for_state): Replace with...
2269         (null_assignment_sm_context::warn): ...this.
2270         * engine.cc (impl_sm_context::warn_for_state): Replace with...
2271         (impl_sm_context::warn): ...this.
2272         * sm-file.cc (fileptr_state_machine::on_stmt): Replace
2273         warn_for_state and on_transition calls with a get_state
2274         test guarding warn and set_next_state calls.
2275         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
2276         * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
2277         Replace warn_for_state call with warn call.
2278         * sm-sensitive.cc
2279         (sensitive_state_machine::warn_for_any_exposure): Replace
2280         warn_for_state call with a get_state test guarding a warn call.
2281         * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
2282         * sm-taint.cc (taint_state_machine::on_stmt):  Replace
2283         warn_for_state and on_transition calls with a get_state
2284         test guarding warn and set_next_state calls.
2285         * sm.h (sm_context::warn_for_state): Replace with...
2286         (sm_context::warn): ...this.
2287
2288 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
2289
2290         * diagnostic-manager.cc
2291         (null_assignment_sm_context::null_assignment_sm_context): Add old_state
2292         and ext_state params, initializing m_old_state and m_ext_state.
2293         (null_assignment_sm_context::on_transition): Split into...
2294         (null_assignment_sm_context::get_state): ...this new vfunc
2295         implementation and...
2296         (null_assignment_sm_context::set_next_state): ...this new vfunc
2297         implementation.
2298         (null_assignment_sm_context::m_old_state): New field.
2299         (null_assignment_sm_context::m_ext_state): New field.
2300         (diagnostic_manager::add_events_for_eedge): Pass in old state and
2301         ext_state when creating sm_ctxt.
2302         * engine.cc (impl_sm_context::on_transition): Split into...
2303         (impl_sm_context::get_state): ...this new vfunc
2304         implementation and...
2305         (impl_sm_context::set_next_state): ...this new vfunc
2306         implementation.
2307         * sm.h (sm_context::get_state): New pure virtual function.
2308         (sm_context::set_next_state): Likewise.
2309         (sm_context::on_transition): Convert from a pure virtual function
2310         to a regular function implemented in terms of get_state and
2311         set_next_state.
2312
2313 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
2314
2315         * checker-path.cc (state_change_event::get_desc): Update
2316         state_machine::get_state_name calls to state::get_name.
2317         (warning_event::get_desc): Likewise.
2318         * diagnostic-manager.cc
2319         (null_assignment_sm_context::on_transition): Update comparison
2320         against 0 with comparison with m_sm.get_start_state.
2321         (diagnostic_manager::prune_for_sm_diagnostic): Update
2322         state_machine::get_state_name calls to state::get_name.
2323         * engine.cc (impl_sm_context::on_transition): Likewise.
2324         (exploded_node::get_dot_fillcolor): Use get_id when summing
2325         the sm states.
2326         * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
2327         0 as the start state when initializing m_global_state.
2328         (sm_state_map::print): Use dump_to_pp rather than get_state_name
2329         when dumping states.
2330         (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
2331         when examining m_global_state.
2332         (sm_state_map::hash): Use get_id when hashing states.
2333         (selftest::test_sm_state_map): Use state objects rather than
2334         arbitrary hardcoded integers.
2335         (selftest::test_program_state_merging): Likewise.
2336         (selftest::test_program_state_merging_2): Likewise.
2337         * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
2338         (file_diagnostic::describe_state_change): Use get_start_state.
2339         (fileptr_state_machine::fileptr_state_machine): Drop m_start
2340         initialization.
2341         * sm-malloc.cc (malloc_state_machine::m_start): Move to base
2342         class.
2343         (malloc_diagnostic::describe_state_change): Use get_start_state.
2344         (possible_null::describe_state_change): Likewise.
2345         (malloc_state_machine::malloc_state_machine): Drop m_start
2346         initialization.
2347         * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
2348         to base class.
2349         (pattern_test_state_machine::pattern_test_state_machine): Drop
2350         m_start initialization.
2351         * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
2352         class.
2353         (sensitive_state_machine::sensitive_state_machine): Drop m_start
2354         initialization.
2355         * sm-signal.cc (signal_state_machine::m_start): Move to base
2356         class.
2357         (signal_state_machine::signal_state_machine): Drop m_start
2358         initialization.
2359         * sm-taint.cc (taint_state_machine::m_start): Move to base class.
2360         (taint_state_machine::taint_state_machine): Drop m_start
2361         initialization.
2362         * sm.cc (state_machine::state::dump_to_pp): New.
2363         (state_machine::state_machine): Move here from sm.h.  Initialize
2364         m_next_state_id and m_start.
2365         (state_machine::add_state): Reimplement in terms of state objects.
2366         (state_machine::get_state_name): Delete.
2367         (state_machine::get_state_by_name): Reimplement in terms of state
2368         objects.  Make const.
2369         (state_machine::validate): Delete.
2370         (state_machine::dump_to_pp): Reimplement in terms of state
2371         objects.
2372         * sm.h (state_machine::state): New class.
2373         (state_machine::state_t): Convert typedef from "unsigned" to
2374         "const state_machine::state *".
2375         (state_machine::state_machine): Move to sm.cc.
2376         (state_machine::get_default_state): Use m_start rather than
2377         hardcoding 0.
2378         (state_machine::get_state_name): Delete.
2379         (state_machine::get_state_by_name): Make const.
2380         (state_machine::get_start_state): New accessor.
2381         (state_machine::alloc_state_id): New.
2382         (state_machine::m_state_names): Drop in favor of...
2383         (state_machine::m_states): New field
2384         (state_machine::m_start): New field
2385         (start_start_p): Delete.
2386
2387 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
2388
2389         PR analyzer/96949
2390         * store.cc (binding_map::apply_ctor_val_to_range): Add
2391         error-handling for the cases where we have symbolic offsets.
2392
2393 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
2394
2395         PR analyzer/96950
2396         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
2397         where min_index == max_index.
2398         (binding_map::apply_ctor_val_to_range): Replace assertion that we
2399         don't have a CONSTRUCTOR value with error-handling.
2400
2401 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
2402
2403         PR analyzer/96962
2404         * region-model.cc (region_model::on_call_pre): Fix guard on switch
2405         on built-ins to only consider BUILT_IN_NORMAL, rather than other
2406         kinds of build-ins.
2407
2408 2020-09-01  David Malcolm  <dmalcolm@redhat.com>
2409
2410         PR analyzer/96792
2411         * region-model.cc (region_model::deref_rvalue): Add the constraint
2412         that PTR_SVAL is non-NULL.
2413
2414 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
2415
2416         PR analyzer/96798
2417         * region-model.cc (region_model::on_call_pre): Handle
2418         BUILT_IN_MEMSET_CHK.
2419
2420 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
2421
2422         * region-model.cc (region_model::on_call_pre): Gather handling of
2423         builtins and of internal fns into switch statements.  Handle
2424         "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
2425
2426 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
2427
2428         PR analyzer/96860
2429         * region.cc (decl_region::get_svalue_for_constructor): Support
2430         apply_ctor_to_region failing.
2431         * store.cc (binding_map::apply_ctor_to_region): Add failure
2432         handling.
2433         (binding_map::apply_ctor_val_to_range): Likewise.
2434         (binding_map::apply_ctor_pair_to_child_region): Likewise.  Replace
2435         assertion that child_base_offset is not symbolic with error
2436         handling.
2437         * store.h (binding_map::apply_ctor_to_region): Convert return type
2438         from void to bool.
2439         (binding_map::apply_ctor_val_to_range): Likewise.
2440         (binding_map::apply_ctor_pair_to_child_region): Likewise.
2441
2442 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
2443
2444         PR analyzer/96763
2445         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
2446         by calling a new binding_map::apply_ctor_val_to_range subroutine.
2447         Split out the existing non-CONSTRUCTOR-handling code to a new
2448         apply_ctor_pair_to_child_region subroutine.
2449         (binding_map::apply_ctor_val_to_range): New.
2450         (binding_map::apply_ctor_pair_to_child_region): New, split out
2451         from binding_map::apply_ctor_to_region as noted above.
2452         * store.h (binding_map::apply_ctor_val_to_range): New decl.
2453         (binding_map::apply_ctor_pair_to_child_region): New decl.
2454
2455 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
2456
2457         PR analyzer/96764
2458         * region-model-manager.cc
2459         (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
2460         (region_model_manager::get_or_create_cast): Move logic for
2461         real->integer casting to...
2462         (get_code_for_cast): ...this new function, and add logic for
2463         real->non-integer casts.
2464         (region_model_manager::maybe_fold_sub_svalue): Handle
2465         VIEW_CONVERT_EXPR.
2466         * region-model.cc
2467         (region_model::add_any_constraints_from_gassign): Likewise.
2468         * svalue.cc (svalue::maybe_undo_cast): Likewise.
2469         (unaryop_svalue::dump_to_pp): Likewise.
2470
2471 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
2472
2473         PR analyzer/94858
2474         * region-model-manager.cc
2475         (region_model_manager::get_or_create_widening_svalue): Assert that
2476         neither of the inputs are themselves widenings.
2477         * store.cc (store::eval_alias_1): The initial value of a pointer
2478         can't point to a region that was allocated on the heap after the
2479         beginning of the path.  A widened pointer value can't alias anything
2480         that the initial pointer value can't alias.
2481         * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
2482         to a widening svalue.  Merge
2483         BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
2484         to the LHS of the first BINOP.
2485
2486 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
2487
2488         PR analyzer/96777
2489         * region-model.h (class compound_svalue): Document that all keys
2490         must be concrete.
2491         (compound_svalue::compound_svalue): Move definition to svalue.cc.
2492         * store.cc (binding_map::apply_ctor_to_region): Handle
2493         initializers for trailing arrays with incomplete size.
2494         * svalue.cc (compound_svalue::compound_svalue): Move definition
2495         here from region-model.h.  Add assertion that all keys are
2496         concrete.
2497
2498 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
2499
2500         PR analyzer/94851
2501         * region-model-manager.cc
2502         (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
2503
2504 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
2505
2506         * store.cc (store::eval_alias): Make const.  Split out 2nd half
2507         into store::eval_alias_1 and call it twice for symmetry, avoiding
2508         test duplication.
2509         (store::eval_alias_1): New function, split out from the above.
2510         * store.h (store::eval_alias): Make const.
2511         (store::eval_alias_1): New decl.
2512
2513 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
2514
2515         * region-model.cc (region_model::push_frame): Bind the default
2516         SSA name for each parm if it exists, falling back to the parm
2517         itself otherwise, rather than doing both.
2518
2519 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
2520
2521         PR analyzer/96723
2522         * region-model-manager.cc
2523         (region_model_manager::get_field_region): Assert that field is a
2524         FIELD_DECL.
2525         * region.cc (region::get_subregions_for_binding): In
2526         union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
2527
2528 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
2529
2530         PR analyzer/96713
2531         * region-model.cc (region_model::get_gassign_result): For
2532         comparisons, only use eval_condition when the lhs has boolean
2533         type, and use get_or_create_constant_svalue on the boolean
2534         constants directly rather than via get_rvalue.
2535
2536 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
2537
2538         PR analyzer/96643
2539         * region-model.cc (region_model::deref_rvalue): Rather than
2540         attempting to handle all svalue kinds in the switch, only cover
2541         the special cases, and move symbolic-region handling to after
2542         the switch, thus implicitly handling the missing case SK_COMPOUND.
2543
2544 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
2545
2546         PR analyzer/96705
2547         * region-model-manager.cc
2548         (region_model_manager::maybe_fold_binop): Check that we have an
2549         integral type before calling build_int_cst.
2550
2551 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
2552
2553         PR analyzer/96699
2554         * region-model-manager.cc
2555         (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
2556         casting from REAL_TYPE to INTEGER_TYPE.
2557
2558 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
2559
2560         PR analyzer/96651
2561         * region-model.cc (region_model::called_from_main_p): New.
2562         (region_model::get_store_value): Move handling for globals into...
2563         (region_model::get_initial_value_for_global): ...this new
2564         function, and add logic for extracting values from decl
2565         initializers.
2566         * region-model.h (decl_region::get_svalue_for_constructor): New
2567         decl.
2568         (decl_region::get_svalue_for_initializer): New decl.
2569         (region_model::called_from_main_p): New decl.
2570         (region_model::get_initial_value_for_global): New.
2571         * region.cc (decl_region::maybe_get_constant_value): Move logic
2572         for getting an svalue from a CONSTRUCTOR node to...
2573         (decl_region::get_svalue_for_constructor): ...this new function.
2574         (decl_region::get_svalue_for_initializer): New.
2575         * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
2576         region_model::get_rvalue.
2577         * store.h (binding_cluster::get_map): New accessor.
2578
2579 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
2580
2581         PR analyzer/96648
2582         * region.cc (get_field_at_bit_offset): Gracefully handle negative
2583         values for bit_offset.
2584
2585 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
2586
2587         * region-model.cc (region_model::get_rvalue_1): Fix name of local.
2588
2589 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
2590
2591         PR analyzer/96641
2592         * region-model.cc (region_model::get_rvalue_1): Handle
2593         unrecognized tree codes by returning "UNKNOWN.
2594
2595 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
2596
2597         PR analyzer/96640
2598         * region-model.cc (region_model::get_gassign_result): Handle various
2599         VEC_* tree codes by returning UNKNOWN.
2600         (region_model::on_assignment): Handle unrecognized tree codes by
2601         setting lhs to an unknown value, rather than issuing a "sorry" and
2602         asserting.
2603
2604 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
2605
2606         PR analyzer/96644
2607         * region-model-manager.cc (get_region_for_unexpected_tree_code):
2608         Handle ctxt being NULL.
2609
2610 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
2611
2612         PR analyzer/96639
2613         * region.cc (region::get_subregions_for_binding): Check for "type"
2614         being NULL.
2615
2616 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
2617
2618         PR analyzer/96642
2619         * store.cc (get_svalue_for_ctor_val): New.
2620         (binding_map::apply_ctor_to_region): Call it.
2621
2622 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
2623
2624         PR testsuite/96609
2625         PR analyzer/96616
2626         * region-model.cc (region_model::get_store_value): Call
2627         maybe_get_constant_value on decl_regions first.
2628         * region-model.h (decl_region::maybe_get_constant_value): New decl.
2629         * region.cc (decl_region::get_stack_depth): Likewise.
2630         (decl_region::maybe_get_constant_value): New.
2631         * store.cc (get_subregion_within_ctor): New.
2632         (binding_map::apply_ctor_to_region): New.
2633         * store.h (binding_map::apply_ctor_to_region): New decl.
2634
2635 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
2636
2637         PR analyzer/96611
2638         * store.cc (store::mark_as_escaped): Reject attempts to
2639         get a cluster for an unknown pointer.
2640
2641 2020-08-13  David Malcolm  <dmalcolm@redhat.com>
2642
2643         PR analyzer/93032
2644         PR analyzer/93938
2645         PR analyzer/94011
2646         PR analyzer/94099
2647         PR analyzer/94399
2648         PR analyzer/94458
2649         PR analyzer/94503
2650         PR analyzer/94640
2651         PR analyzer/94688
2652         PR analyzer/94689
2653         PR analyzer/94839
2654         PR analyzer/95026
2655         PR analyzer/95042
2656         PR analyzer/95240
2657         * analyzer-logging.cc: Ignore "-Wformat-diag".
2658         (logger::enter_scope): Use inc_indent in both overloads.
2659         (logger::exit_scope): Use dec_indent.
2660         * analyzer-logging.h (logger::inc_indent): New.
2661         (logger::dec_indent): New.
2662         * analyzer-selftests.cc (run_analyzer_selftests): Call
2663         analyzer_store_cc_tests.
2664         * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
2665         * analyzer.cc (get_stmt_location): New function.
2666         * analyzer.h (class initial_svalue): New forward decl.
2667         (class unaryop_svalue): New forward decl.
2668         (class binop_svalue): New forward decl.
2669         (class sub_svalue): New forward decl.
2670         (class unmergeable_svalue): New forward decl.
2671         (class placeholder_svalue): New forward decl.
2672         (class widening_svalue): New forward decl.
2673         (class compound_svalue): New forward decl.
2674         (class conjured_svalue): New forward decl.
2675         (svalue_set): New typedef.
2676         (class map_region): Delete.
2677         (class array_region): Delete.
2678         (class frame_region): New forward decl.
2679         (class function_region): New forward decl.
2680         (class label_region): New forward decl.
2681         (class decl_region): New forward decl.
2682         (class element_region): New forward decl.
2683         (class offset_region): New forward decl.
2684         (class cast_region): New forward decl.
2685         (class field_region): New forward decl.
2686         (class string_region): New forward decl.
2687         (class region_model_manager): New forward decl.
2688         (class store_manager): New forward decl.
2689         (class store): New forward decl.
2690         (class call_details): New forward decl.
2691         (struct svalue_id_merger_mapping): Delete.
2692         (struct canonicalization): Delete.
2693         (class function_point): New forward decl.
2694         (class engine): New forward decl.
2695         (dump_tree): New function decl.
2696         (print_quoted_type): New function decl.
2697         (readability_comparator): New function decl.
2698         (tree_cmp): New function decl.
2699         (class path_var): Move here from region-model.h
2700         (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
2701         (class region_offset): New class.
2702         (get_stmt_location): New decl.
2703         (struct member_function_hash_traits): New struct.
2704         (class consolidation_map): New class.
2705         Ignore "-Wformat-diag".
2706         * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
2707         (-param=analyzer-max-enodes-for-full-dump=): New param.
2708         * call-string.cc: Ignore -Wformat-diag.
2709         * checker-path.cc: Move includes of "analyzer/call-string.h" and
2710         "analyzer/program-point.h" to before "analyzer/region-model.h",
2711         and also include "analyzer/store.h" before it.
2712         (state_change_event::state_change_event): Replace "tree var" param
2713         with "const svalue *sval".  Convert "origin" param from tree to
2714         "const svalue *".
2715         (state_change_event::get_desc): Call get_representative_tree to
2716         convert the var and origin from const svalue * to tree.  Use
2717         svalue::get_desc rather than %qE when describing state changes.
2718         (checker_path::add_final_event): Use get_stmt_location.
2719         * checker-path.h (state_change_event::state_change_event): Port
2720         from tree to const svalue *.
2721         (state_change_event::get_lvalue): Delete.
2722         (state_change_event::get_dest_function): New.
2723         (state_change_event::m_var): Replace with...
2724         (state_change_event::m_sval): ...this.
2725         (state_change_event::m_origin): Convert from tree to
2726         const svalue *.
2727         * constraint-manager.cc: Include "analyzer/call-string.h",
2728         "analyzer/program-point.h", and "analyzer/store.h" before
2729         "analyzer/region-model.h".
2730         (struct bound, struct range): Move to constraint-manager.h.
2731         (compare_constants): New function.
2732         (range::dump): Rename to...
2733         (range::dump_to_pp): ...this.  Support NULL constants.
2734         (range::dump): Reintroduce for dumping to stderr.
2735         (range::constrained_to_single_element): Return result, rather than
2736         writing to *OUT.
2737         (range::eval_condition): New.
2738         (range::below_lower_bound): New.
2739         (range::above_upper_bound): New.
2740         (equiv_class::equiv_class): Port from svalue_id to const svalue *.
2741         (equiv_class::print): Likewise.
2742         (equiv_class::hash): Likewise.
2743         (equiv_class::operator==): Port from svalue_id to const svalue *.
2744         (equiv_class::add): Port from svalue_id to const svalue *. Drop
2745         "cm" param.
2746         (equiv_class::del): Port from svalue_id to const svalue *.
2747         (equiv_class::get_representative): Likewise.
2748         (equiv_class::remap_svalue_ids): Delete.
2749         (svalue_id_cmp_by_id): Rename to...
2750         (svalue_cmp_by_ptr): ...this, porting from svalue_id to
2751         const svalue *.
2752         (equiv_class::canonicalize): Update qsort comparator.
2753         (constraint::implied_by): New.
2754         (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
2755         (constraint_manager::dump_to_pp): Add "multiline" param
2756         (constraint_manager::dump): Pass "true" for "multiline".
2757         (constraint_manager::add_constraint): Port from svalue_id to
2758         const svalue *.  Split out second part into...
2759         (constraint_manager::add_unknown_constraint): ...this new
2760         function.  Remove self-constraints when merging equivalence
2761         classes.
2762         (constraint_manager::add_constraint_internal): Remove constraints
2763         that would be implied by the new constraint.  Port from svalue_id
2764         to const svalue *.
2765         (constraint_manager::get_equiv_class_by_sid): Rename to...
2766         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
2767         from svalue_id to const svalue *.
2768         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
2769         to const svalue *.
2770         (constraint_manager::eval_condition): Make const.  Call
2771         compare_constants and return early if it provides a known result.
2772         (constraint_manager::get_ec_bounds): New.
2773         (constraint_manager::eval_condition): New overloads.  Make
2774         existing one const, and use compare_constants.
2775         (constraint_manager::purge): Convert "p" param to a template
2776         rather that an abstract base class.  Port from svalue_id to
2777         const svalue *.
2778         (class dead_svalue_purger): New class.
2779         (constraint_manager::remap_svalue_ids): Delete.
2780         (constraint_manager::on_liveness_change): New.
2781         (equiv_class_cmp): Port from svalue_id to const svalue *.
2782         (constraint_manager::canonicalize): Likewise.  Combine with
2783         purging of redundant equivalence classes and constraints.
2784         (class cleaned_constraint_manager): Delete.
2785         (class merger_fact_visitor): Make "m_cm_b" const.  Add "m_merger"
2786         field.
2787         (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
2788         Add special case for widening.
2789         (constraint_manager::merge): Port from svalue_id to const svalue *.
2790         (constraint_manager::clean_merger_input): Delete.
2791         (constraint_manager::for_each_fact): Port from svalue_id to
2792         const svalue *.
2793         (constraint_manager::validate): Likewise.
2794         (selftest::test_constraint_conditions): Provide a
2795         region_model_manager when creating region_model instances.
2796         Add test for self-equality not creating equivalence classes.
2797         (selftest::test_transitivity): Provide a region_model_manager when
2798         creating region_model instances.  Verify that EC-merging happens
2799         when constraints are implied.
2800         (selftest::test_constant_comparisons):  Provide a
2801         region_model_manager when creating region_model instances.
2802         (selftest::test_constraint_impl): Likewise.  Remove over-specified
2803         assertions.
2804         (selftest::test_equality): Provide a region_model_manager when
2805         creating region_model instances.
2806         (selftest::test_many_constants): Likewise.  Provide a
2807         program_point when testing merging.
2808         (selftest::run_constraint_manager_tests): Move call to
2809         test_constant_comparisons to outside the transitivity guard.
2810         * constraint-manager.h (struct bound): Move here from
2811         constraint-manager.cc.
2812         (struct range): Likewise.
2813         (struct::eval_condition): New decl.
2814         (struct::below_lower_bound): New decl.
2815         (struct::above_upper_bound): New decl.
2816         (equiv_class::add): Port from svalue_id to const svalue *.
2817         (equiv_class::del): Likewise.
2818         (equiv_class::get_representative): Likewise.
2819         (equiv_class::remap_svalue_ids): Drop.
2820         (equiv_class::m_cst_sid): Convert to..
2821         (equiv_class::m_cst_sval): ...this.
2822         (equiv_class::m_vars): Port from svalue_id to const svalue *.
2823         (constraint::bool implied_by): New decl.
2824         (fact_visitor::on_fact): Port from svalue_id to const svalue *.
2825         (constraint_manager::constraint_manager): Add mgr param.
2826         (constraint_manager::clone): Delete.
2827         (constraint_manager::maybe_get_constant): Delete.
2828         (constraint_manager::get_sid_for_constant): Delete.
2829         (constraint_manager::get_num_svalues): Delete.
2830         (constraint_manager::dump_to_pp): Add "multiline" param.
2831         (constraint_manager::get_equiv_class): Port from svalue_id to
2832         const svalue *.
2833         (constraint_manager::add_constraint):  Likewise.
2834         (constraint_manager::get_equiv_class_by_sid): Rename to...
2835         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
2836         from svalue_id to const svalue *.
2837         (constraint_manager::add_unknown_constraint): New decl.
2838         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
2839         to const svalue *.
2840         (constraint_manager::eval_condition): Likewise.  Add overloads.
2841         (constraint_manager::get_ec_bounds): New decl.
2842         (constraint_manager::purge): Convert to template.
2843         (constraint_manager::remap_svalue_ids): Delete.
2844         (constraint_manager::on_liveness_change): New decl.
2845         (constraint_manager::canonicalize): Drop param.
2846         (constraint_manager::clean_merger_input): Delete.
2847         (constraint_manager::m_mgr): New field.
2848         * diagnostic-manager.cc: Move includes of
2849         "analyzer/call-string.h" and "analyzer/program-point.h" to before
2850         "analyzer/region-model.h", and also include "analyzer/store.h"
2851         before it.
2852         (saved_diagnostic::saved_diagnostic): Add "sval" param.
2853         (diagnostic_manager::diagnostic_manager): Add engine param.
2854         (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
2855         to saved_diagnostic ctor.  Update overload to pass NULL for it.
2856         (dedupe_winners::dedupe_winners): Add engine param.
2857         (dedupe_winners::add): Add "eg" param.  Pass m_engine to
2858         feasible_p.
2859         (dedupe_winner::m_engine): New field.
2860         (diagnostic_manager::emit_saved_diagnostics): Pass engine to
2861         dedupe_winners.  Pass &eg when adding candidates.  Pass svalue
2862         rather than tree to prune_path.  Use get_stmt_location to get
2863         primary location of diagnostic.
2864         (diagnostic_manager::emit_saved_diagnostic): Likewise.
2865         (get_any_origin): Drop.
2866         (state_change_event_creator::on_global_state_change): Pass NULL
2867         const svalue * rather than NULL_TREE trees to state_change_event
2868         ctor.
2869         (state_change_event_creator::on_state_change): Port from tree and
2870         svalue_id to const svalue *.
2871         (for_each_state_change): Port from svalue_id to const svalue *.
2872         (struct null_assignment_sm_context): New.
2873         (diagnostic_manager::add_events_for_eedge):  Add state change
2874         events for assignment to NULL.
2875         (diagnostic_manager::prune_path): Update param from tree to
2876         const svalue *.
2877         (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
2878         by tree to by const svalue *.
2879         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
2880         param.
2881         (saved_diagnostic::m_sval): New field.
2882         (diagnostic_manager::diagnostic_manager): Add engine param.
2883         (diagnostic_manager::get_engine): New.
2884         (diagnostic_manager::add_diagnostic): Add "sval" param.
2885         (diagnostic_manager::prune_path): Likewise.
2886         (diagnostic_manager::prune_for_sm_diagnostic): New overload.
2887         (diagnostic_manager::m_eng): New field.
2888         * engine.cc: Move includes of "analyzer/call-string.h" and
2889         "analyzer/program-point.h" to before "analyzer/region-model.h",
2890         and also include "analyzer/store.h" before it.
2891         (impl_region_model_context::impl_region_model_context): Update for
2892         removal of m_change field.
2893         (impl_region_model_context::remap_svalue_ids): Delete.
2894         (impl_region_model_context::on_svalue_leak): New.
2895         (impl_region_model_context::on_svalue_purge): Delete.
2896         (impl_region_model_context::on_liveness_change): New.
2897         (impl_region_model_context::on_unknown_change): Update param
2898         from svalue_id to const svalue *.  Add is_mutable param.
2899         (setjmp_svalue::compare_fields): Delete.
2900         (setjmp_svalue::accept): New.
2901         (setjmp_svalue::add_to_hash): Delete.
2902         (setjmp_svalue::dump_to_pp): New.
2903         (setjmp_svalue::print_details): Delete.
2904         (impl_sm_context::impl_sm_context): Drop "change" param.
2905         (impl_sm_context::get_fndecl_for_call): Drop "m_change".
2906         (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
2907         "stmt" param.  Drop m_change.  Port from svalue_id to
2908         const svalue *.
2909         (impl_sm_context::warn_for_state): Drop m_change.  Port from
2910         svalue_id to const svalue *.
2911         (impl_sm_context::get_readable_tree): Rename to...
2912         (impl_sm_context::get_diagnostic_tree): ...this.  Port from
2913         svalue_id to const svalue *.
2914         (impl_sm_context::is_zero_assignment): New.
2915         (impl_sm_context::m_change): Delete field.
2916         (leak_stmt_finder::find_stmt): Handle m_var being NULL.
2917         (readability):  Increase penalty for MEM_REF.  For SSA_NAMEs,
2918         slightly favor the underlying var over the SSA name.  Heavily
2919         penalize temporaries.  Handle RESULT_DECL.
2920         (readability_comparator): Make non-static.  Consider stack depths.
2921         (impl_region_model_context::on_state_leak): Convert from svalue_id
2922         to const svalue *, updating for region_model changes.  Use
2923         id_equal.
2924         (impl_region_model_context::on_inherited_svalue): Delete.
2925         (impl_region_model_context::on_cast): Delete.
2926         (impl_region_model_context::on_condition):  Drop m_change.
2927         (impl_region_model_context::on_phi): Likewise.
2928         (impl_region_model_context::on_unexpected_tree_code): Handle t
2929         being NULL.
2930         (point_and_state::validate): Update stack checking for
2931         region_model changes.
2932         (eg_traits::dump_args_t::show_enode_details_p): New.
2933         (exploded_node::exploded_node): Initialize m_num_processed_stmts.
2934         (exploded_node::get_processed_stmt): New function.
2935         (exploded_node::get_dot_fillcolor): Add more colors.
2936         (exploded_node::dump_dot): Guard the printing of the point and
2937         state with show_enode_details_p.  Print the processed stmts for
2938         this enode after the initial state.
2939         (exploded_node::dump_to_pp): Pass true for new multiline param
2940         of program_state::dump_to_pp.
2941         (exploded_node::on_stmt): Drop "change" param.  Log the stmt.
2942         Set input_location.  Implement __analyzer_describe.  Update
2943         implementation of __analyzer_dump and __analyzer_eval.
2944         Remove purging of sm-state for unknown fncalls from here.
2945         (exploded_node::on_edge): Drop "change" param.
2946         (exploded_node::on_longjmp): Port from region_id/svalue_id to
2947         const region */const svalue *.  Call program_state::detect_leaks.
2948         Drop state_change.
2949         (exploded_node::detect_leaks): Update for changes to region_model.
2950         Call program_state::detect_leaks.
2951         (exploded_edge::exploded_edge): Drop ext_state and change params.
2952         (exploded_edge::dump_dot): "args" is no longer used.  Drop dumping
2953         of m_change.
2954         (exploded_graph::exploded_graph): Pass engine to
2955         m_diagnostic_manager ctor.  Use program_point::origin.
2956         (exploded_graph::add_function_entry):  Drop ctxt.  Use
2957         program_state::push_frame.  Drop state_change.
2958         (exploded_graph::get_or_create_node): Drop "change" param.  Add
2959         "enode_for_diag" param.  Update dumping calls for API changes.
2960         Pass point to can_merge_with_p.  Show enode indices
2961         within -Wanalyzer-too-complex diagnostic for hitting the per-point
2962         limit.
2963         (exploded_graph::add_edge): Drop "change" param.  Log which nodes
2964         are being connected.  Update for changes to exploded_edge ctor.
2965         (exploded_graph::get_per_program_point_data): New.
2966         (exploded_graph::process_worklist): Pass point to
2967         can_merge_with_p.  Drop state_change.  Update dumping call for API
2968         change.
2969         (exploded_graph::process_node):  Drop state_change.  Split the
2970         node in-place if an sm-state-change occurs.  Update
2971         m_num_processed_stmts.  Update dumping calls for API change.
2972         (exploded_graph::log_stats): Call engine::log_stats.
2973         (exploded_graph::dump_states_for_supernode): Update dumping
2974         call.
2975         (exploded_path::feasible_p): Add "eng" and "eg" params.
2976         Rename "i" to "end_idx".  Pass the manager to the region_model
2977         ctor.  Update for every processed stmt in the enode, not just the
2978         first.  Keep track of which snodes have been visited, and call
2979         loop_replay_fixup when revisiting one.
2980         (enode_label::get_text): Update dump call for new param.
2981         (exploded_graph::dump_exploded_nodes): Likewise.
2982         (exploded_graph::get_node_by_index): New.
2983         (impl_run_checkers): Create engine instance and pass its address
2984         to extrinsic_state ctor.
2985         * exploded-graph.h
2986         (impl_region_model_context::impl_region_model_context): Drop
2987         "change" params.
2988         (impl_region_model_context::void remap_svalue_ids): Delete.
2989         (impl_region_model_context::on_svalue_purge): Delete.
2990         (impl_region_model_context::on_svalue_leak): New.
2991         (impl_region_model_context::on_liveness_change): New.
2992         (impl_region_model_context::on_state_leak): Update signature.
2993         (impl_region_model_context::on_inherited_svalue): Delete.
2994         (impl_region_model_context::on_cast): Delete.
2995         (impl_region_model_context::on_unknown_change): Update signature.
2996         (impl_region_model_context::m_change): Delete.
2997         (eg_traits::dump_args_t::show_enode_details_p): New.
2998         (exploded_node::on_stmt): Drop "change" param.
2999         (exploded_node::on_edge): Likewise.
3000         (exploded_node::get_processed_stmt): New decl.
3001         (exploded_node::m_num_processed_stmts): New field.
3002         (exploded_edge::exploded_edge): Drop ext_state and change params.
3003         (exploded_edge::m_change): Delete.
3004         (exploded_graph::get_engine): New accessor.
3005         (exploded_graph::get_or_create_node): Drop "change" param.  Add
3006         "enode_for_diag" param.
3007         (exploded_graph::add_edge): Drop "change" param.
3008         (exploded_graph::get_per_program_point_data): New decl.
3009         (exploded_graph::get_node_by_index): New decl.
3010         (exploded_path::feasible_p): Add "eng" and "eg" params.
3011         * program-point.cc: Include "analyzer/store.h" before including
3012         "analyzer/region-model.h".
3013         (function_point::function_point): Move here from
3014         program-point.h.
3015         (function_point::get_function): Likewise.
3016         (function_point::from_function_entry): Likewise.
3017         (function_point::before_supernode): Likewise.
3018         (function_point::next_stmt): New function.
3019         * program-point.h (function_point::function_point): Move
3020         implementation from here to program-point.cc.
3021         (function_point::get_function): Likewise.
3022         (function_point::from_function_entry): Likewise.
3023         (function_point::before_supernode): Likewise.
3024         (function_point::next_stmt): New decl.
3025         (program_point::operator!=): New.
3026         (program_point::origin): New.
3027         (program_point::next_stmt): New.
3028         (program_point::m_function_point): Make non-const.
3029         * program-state.cc: Move includes of "analyzer/call-string.h" and
3030         "analyzer/program-point.h" to before "analyzer/region-model.h",
3031         and also include "analyzer/store.h" before it.
3032         (extrinsic_state::get_model_manager): New.
3033         (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
3034         rather than pass the around.
3035         (sm_state_map::clone_with_remapping): Delete.
3036         (sm_state_map::print): Remove "sm" param in favor of "m_sm".  Add
3037         "simple" and "multiline" params and support multiline vs single
3038         line dumping.
3039         (sm_state_map::dump): Remove "sm" param in favor of "m_sm".  Add
3040         "simple" param.
3041         (sm_state_map::hash): Port from svalue_id to const svalue *.
3042         (sm_state_map::operator==): Likewise.
3043         (sm_state_map::get_state): Likewise.  Call canonicalize_svalue on
3044         input.  Handle inheritance of sm-state.  Call get_default_state.
3045         (sm_state_map::get_origin): Port from svalue_id to const svalue *.
3046         (sm_state_map::set_state): Likewise.  Pass in ext_state.  Reject
3047         attempts to set state on UNKNOWN.
3048         (sm_state_map::impl_set_state): Port from svalue_id to
3049         const svalue *.  Pass in ext_state.  Call canonicalize_svalue on
3050         input.
3051         (sm_state_map::purge_for_unknown_fncall): Delete.
3052         (sm_state_map::on_svalue_leak): New.
3053         (sm_state_map::remap_svalue_ids): Delete.
3054         (sm_state_map::on_liveness_change): New.
3055         (sm_state_map::on_unknown_change): Reimplement.
3056         (sm_state_map::on_svalue_purge): Delete.
3057         (sm_state_map::on_inherited_svalue): Delete.
3058         (sm_state_map::on_cast): Delete.
3059         (sm_state_map::validate): Delete.
3060         (sm_state_map::canonicalize_svalue): New.
3061         (program_state::program_state): Update to pass manager to
3062         region_model's ctor.  Constify num_states and pass state machine
3063         and index to sm_state_map ctor.
3064         (program_state::print): Update for changes to dump API.
3065         (program_state::dump_to_pp): Ignore the summarize param.  Add
3066         "multiline" param.
3067         (program_state::dump_to_file): Add "multiline" param.
3068         (program_state::dump): Pass "true" for new "multiline" param.
3069         (program_state::push_frame): New.
3070         (program_state::on_edge): Drop "change" param.  Call
3071         program_state::detect_leaks.
3072         (program_state::prune_for_point): Add enode_for_diag param.
3073         Reimplement based on store class.  Call detect_leaks
3074         (program_state::remap_svalue_ids): Delete.
3075         (program_state::get_representative_tree): Port from svalue_id to
3076         const svalue *.
3077         (program_state::can_merge_with_p): Add "point" param.  Add early
3078         reject for sm-differences.  Drop id remapping.
3079         (program_state::validate): Drop region model and sm_state_map
3080         validation.
3081         (state_change::sm_change::dump): Delete.
3082         (state_change::sm_change::remap_svalue_ids): Delete.
3083         (state_change::sm_change::on_svalue_purge): Delete.
3084         (log_set_of_svalues): New.
3085         (state_change::sm_change::validate): Delete.
3086         (state_change::state_change): Delete.
3087         (state_change::add_sm_change): Delete.
3088         (state_change::affects_p): Delete.
3089         (state_change::dump): Delete.
3090         (state_change::remap_svalue_ids): Delete.
3091         (state_change::on_svalue_purge): Delete.
3092         (state_change::validate): Delete.
3093         (selftest::assert_dump_eq): Delete.
3094         (ASSERT_DUMP_EQ): Delete.
3095         (selftest::test_sm_state_map): Update for changes to region_model
3096         and sm_state_map, porting from svalue_id to const svalue *.
3097         (selftest::test_program_state_dumping): Likewise.  Drop test of
3098         dumping, renaming to...
3099         (selftest::test_program_state_1): ...this.
3100         (selftest::test_program_state_dumping_2): Likewise, renaming to...
3101         (selftest::test_program_state_2): ...this.
3102         (selftest::test_program_state_merging): Update for changes to
3103         region_model.
3104         (selftest::test_program_state_merging_2): Likewise.
3105         (selftest::analyzer_program_state_cc_tests): Update for renamed
3106         tests.
3107         * program-state.h (extrinsic_state::extrinsic_state): Add logger
3108         and engine params.
3109         (extrinsic_state::get_logger): New accessor.
3110         (extrinsic_state::get_engine): New accessor.
3111         (extrinsic_state::get_model_manager): New accessor.
3112         (extrinsic_state::m_logger): New field.
3113         (extrinsic_state::m_engine): New field.
3114         (struct default_hash_traits<svalue_id>): Delete.
3115         (pod_hash_traits<svalue_id>::hash): Delete.
3116         (pod_hash_traits<svalue_id>::equal): Delete.
3117         (pod_hash_traits<svalue_id>::mark_deleted): Delete.
3118         (pod_hash_traits<svalue_id>::mark_empty): Delete.
3119         (pod_hash_traits<svalue_id>::is_deleted): Delete.
3120         (pod_hash_traits<svalue_id>::is_empty): Delete.
3121         (sm_state_map::entry_t::entry_t): Port from svalue_id to
3122         const svalue *.
3123         (sm_state_map::entry_t::m_origin): Likewise.
3124         (sm_state_map::map_t): Likewise.
3125         (sm_state_map::sm_state_map): Add state_machine and index params.
3126         (sm_state_map::clone_with_remapping): Delete.
3127         (sm_state_map::print):  Drop sm param; add simple and multiline
3128         params.
3129         (sm_state_map::dump): Drop sm param; add simple param.
3130         (sm_state_map::get_state): Port from svalue_id to const svalue *.
3131         Add ext_state param.
3132         (sm_state_map::get_origin): Likewise.
3133         (sm_state_map::set_state): Likewise.
3134         (sm_state_map::impl_set_state): Likewise.
3135         (sm_state_map::purge_for_unknown_fncall): Delete.
3136         (sm_state_map::remap_svalue_ids): Delete.
3137         (sm_state_map::on_svalue_purge): Delete.
3138         (sm_state_map::on_svalue_leak): New.
3139         (sm_state_map::on_liveness_change): New.
3140         (sm_state_map::on_inherited_svalue): Delete.
3141         (sm_state_map::on_cast): Delete.
3142         (sm_state_map::validate): Delete.
3143         (sm_state_map::on_unknown_change): Port from svalue_id to
3144         const svalue *.  Add is_mutable and ext_state params.
3145         (sm_state_map::canonicalize_svalue): New.
3146         (sm_state_map::m_sm): New field.
3147         (sm_state_map::m_sm_idx): New field.
3148         (program_state::operator=): Delete.
3149         (program_state::dump_to_pp): Drop "summarize" param, adding
3150         "simple" and "multiline".
3151         (program_state::dump_to_file): Likewise.
3152         (program_state::dump): Rename "summarize" to "simple".
3153         (program_state::push_frame): New.
3154         (program_state::get_current_function): New.
3155         (program_state::on_edge): Drop "change" param.
3156         (program_state::prune_for_point): Likewise.  Add enode_for_diag
3157         param.
3158         (program_state::remap_svalue_ids): Delete.
3159         (program_state::get_representative_tree): Port from svalue_id to
3160         const svalue *.
3161         (program_state::can_purge_p): Likewise.  Pass ext_state to get_state.
3162         (program_state::can_merge_with_p): Add point param.
3163         (program_state::detect_leaks): New.
3164         (state_change_visitor::on_state_change): Port from tree and
3165         svalue_id to a pair of const svalue *.
3166         (class state_change): Delete.
3167         * region.cc: New file.
3168         * region-model-impl-calls.cc: New file.
3169         * region-model-manager.cc: New file.
3170         * region-model-reachability.cc: New file.
3171         * region-model-reachability.h: New file.
3172         * region-model.cc: Include "analyzer/call-string.h",
3173         "analyzer/program-point.h", and "analyzer/store.h" before
3174         "analyzer/region-model.h".  Include
3175         "analyzer/region-model-reachability.h".
3176         (dump_tree): Make non-static.
3177         (dump_quoted_tree): Make non-static.
3178         (print_quoted_type): Make non-static.
3179         (path_var::dump): Delete.
3180         (dump_separator): Delete.
3181         (class impl_constraint_manager): Delete.
3182         (svalue_id::print): Delete.
3183         (svalue_id::dump_node_name_to_pp): Delete.
3184         (svalue_id::validate): Delete.
3185         (region_id::print): Delete.
3186         (region_id::dump_node_name_to_pp): Delete.
3187         (region_id::validate): Delete.
3188         (region_id_set::region_id_set): Delete.
3189         (svalue_id_set::svalue_id_set): Delete.
3190         (svalue::operator==): Delete.
3191         (svalue::hash): Delete.
3192         (svalue::print): Delete.
3193         (svalue::dump_dot_to_pp): Delete.
3194         (svalue::remap_region_ids): Delete.
3195         (svalue::walk_for_canonicalization): Delete.
3196         (svalue::get_child_sid): Delete.
3197         (svalue::maybe_get_constant): Delete.
3198         (region_svalue::compare_fields): Delete.
3199         (region_svalue::add_to_hash): Delete.
3200         (region_svalue::print_details): Delete.
3201         (region_svalue::dump_dot_to_pp): Delete.
3202         (region_svalue::remap_region_ids): Delete.
3203         (region_svalue::merge_values): Delete.
3204         (region_svalue::walk_for_canonicalization): Delete.
3205         (region_svalue::eval_condition): Delete.
3206         (constant_svalue::compare_fields): Delete.
3207         (constant_svalue::add_to_hash): Delete.
3208         (constant_svalue::merge_values): Delete.
3209         (constant_svalue::eval_condition): Move to svalue.cc.
3210         (constant_svalue::print_details): Delete.
3211         (constant_svalue::get_child_sid): Delete.
3212         (unknown_svalue::compare_fields): Delete.
3213         (unknown_svalue::add_to_hash): Delete.
3214         (unknown_svalue::print_details): Delete.
3215         (poison_kind_to_str): Move to svalue.cc.
3216         (poisoned_svalue::compare_fields): Delete.
3217         (poisoned_svalue::add_to_hash): Delete.
3218         (poisoned_svalue::print_details): Delete.
3219         (region_kind_to_str): Move to region.cc and reimplement.
3220         (region::operator==): Delete.
3221         (region::get_parent_region): Delete.
3222         (region::set_value): Delete.
3223         (region::become_active_view): Delete.
3224         (region::deactivate_any_active_view): Delete.
3225         (region::deactivate_view): Delete.
3226         (region::get_value): Delete.
3227         (region::get_inherited_child_sid): Delete.
3228         (region_model::copy_region): Delete.
3229         (region_model::copy_struct_region): Delete.
3230         (region_model::copy_union_region): Delete.
3231         (region_model::copy_array_region): Delete.
3232         (region::hash): Delete.
3233         (region::print): Delete.
3234         (region::dump_dot_to_pp): Delete.
3235         (region::dump_to_pp): Delete.
3236         (region::dump_child_label): Delete.
3237         (region::validate): Delete.
3238         (region::remap_svalue_ids): Delete.
3239         (region::remap_region_ids): Delete.
3240         (region::add_view): Delete.
3241         (region::get_view): Delete.
3242         (region::region): Move to region.cc.
3243         (region::add_to_hash): Delete.
3244         (region::print_fields): Delete.
3245         (region::non_null_p): Delete.
3246         (primitive_region::clone): Delete.
3247         (primitive_region::walk_for_canonicalization): Delete.
3248         (map_region::map_region): Delete.
3249         (map_region::compare_fields): Delete.
3250         (map_region::print_fields): Delete.
3251         (map_region::validate): Delete.
3252         (map_region::dump_dot_to_pp): Delete.
3253         (map_region::dump_child_label): Delete.
3254         (map_region::get_or_create): Delete.
3255         (map_region::get): Delete.
3256         (map_region::add_to_hash): Delete.
3257         (map_region::remap_region_ids): Delete.
3258         (map_region::unbind): Delete.
3259         (map_region::get_tree_for_child_region): Delete.
3260         (map_region::get_tree_for_child_region): Delete.
3261         (tree_cmp): Move to region.cc.
3262         (map_region::can_merge_p): Delete.
3263         (map_region::walk_for_canonicalization): Delete.
3264         (map_region::get_value_by_name): Delete.
3265         (struct_or_union_region::valid_key_p): Delete.
3266         (struct_or_union_region::compare_fields): Delete.
3267         (struct_region::clone): Delete.
3268         (struct_region::compare_fields): Delete.
3269         (union_region::clone): Delete.
3270         (union_region::compare_fields): Delete.
3271         (frame_region::compare_fields): Delete.
3272         (frame_region::clone): Delete.
3273         (frame_region::valid_key_p): Delete.
3274         (frame_region::print_fields): Delete.
3275         (frame_region::add_to_hash): Delete.
3276         (globals_region::compare_fields): Delete.
3277         (globals_region::clone): Delete.
3278         (globals_region::valid_key_p): Delete.
3279         (code_region::compare_fields): Delete.
3280         (code_region::clone): Delete.
3281         (code_region::valid_key_p): Delete.
3282         (array_region::array_region): Delete.
3283         (array_region::get_element): Delete.
3284         (array_region::clone): Delete.
3285         (array_region::compare_fields): Delete.
3286         (array_region::print_fields): Delete.
3287         (array_region::validate): Delete.
3288         (array_region::dump_dot_to_pp): Delete.
3289         (array_region::dump_child_label): Delete.
3290         (array_region::get_or_create): Delete.
3291         (array_region::get): Delete.
3292         (array_region::add_to_hash): Delete.
3293         (array_region::remap_region_ids): Delete.
3294         (array_region::get_key_for_child_region): Delete.
3295         (array_region::key_cmp): Delete.
3296         (array_region::walk_for_canonicalization): Delete.
3297         (array_region::key_from_constant): Delete.
3298         (array_region::constant_from_key): Delete.
3299         (function_region::compare_fields): Delete.
3300         (function_region::clone): Delete.
3301         (function_region::valid_key_p): Delete.
3302         (stack_region::stack_region): Delete.
3303         (stack_region::compare_fields): Delete.
3304         (stack_region::clone): Delete.
3305         (stack_region::print_fields): Delete.
3306         (stack_region::dump_child_label): Delete.
3307         (stack_region::validate): Delete.
3308         (stack_region::push_frame): Delete.
3309         (stack_region::get_current_frame_id): Delete.
3310         (stack_region::pop_frame): Delete.
3311         (stack_region::add_to_hash): Delete.
3312         (stack_region::remap_region_ids): Delete.
3313         (stack_region::can_merge_p): Delete.
3314         (stack_region::walk_for_canonicalization): Delete.
3315         (stack_region::get_value_by_name): Delete.
3316         (heap_region::heap_region): Delete.
3317         (heap_region::compare_fields): Delete.
3318         (heap_region::clone): Delete.
3319         (heap_region::walk_for_canonicalization): Delete.
3320         (root_region::root_region): Delete.
3321         (root_region::compare_fields): Delete.
3322         (root_region::clone): Delete.
3323         (root_region::print_fields): Delete.
3324         (root_region::validate): Delete.
3325         (root_region::dump_child_label): Delete.
3326         (root_region::push_frame): Delete.
3327         (root_region::get_current_frame_id): Delete.
3328         (root_region::pop_frame): Delete.
3329         (root_region::ensure_stack_region): Delete.
3330         (root_region::get_stack_region): Delete.
3331         (root_region::ensure_globals_region): Delete.
3332         (root_region::get_code_region): Delete.
3333         (root_region::ensure_code_region): Delete.
3334         (root_region::get_globals_region): Delete.
3335         (root_region::ensure_heap_region): Delete.
3336         (root_region::get_heap_region): Delete.
3337         (root_region::remap_region_ids): Delete.
3338         (root_region::can_merge_p): Delete.
3339         (root_region::add_to_hash): Delete.
3340         (root_region::walk_for_canonicalization): Delete.
3341         (root_region::get_value_by_name): Delete.
3342         (symbolic_region::symbolic_region): Delete.
3343         (symbolic_region::compare_fields): Delete.
3344         (symbolic_region::clone): Delete.
3345         (symbolic_region::walk_for_canonicalization): Delete.
3346         (symbolic_region::print_fields): Delete.
3347         (region_model::region_model): Add region_model_manager * param.
3348         Reimplement in terms of store, dropping impl_constraint_manager
3349         subclass.
3350         (region_model::operator=): Reimplement in terms of store
3351         (region_model::operator==): Likewise.
3352         (region_model::hash): Likewise.
3353         (region_model::print): Delete.
3354         (region_model::print_svalue): Delete.
3355         (region_model::dump_dot_to_pp): Delete.
3356         (region_model::dump_dot_to_file): Delete.
3357         (region_model::dump_dot): Delete.
3358         (region_model::dump_to_pp): Replace "summarize" param with
3359         "simple" and "multiline".  Port to store-based implementation.
3360         (region_model::dump): Replace "summarize" param with "simple" and
3361         "multiline".
3362         (dump_vec_of_tree): Delete.
3363         (region_model::dump_summary_of_rep_path_vars): Delete.
3364         (region_model::validate): Delete.
3365         (svalue_id_cmp_by_constant_svalue_model): Delete.
3366         (svalue_id_cmp_by_constant_svalue): Delete.
3367         (region_model::canonicalize): Drop "ctxt" param.  Reimplement in
3368         terms of store and constraints.
3369         (region_model::canonicalized_p): Remove NULL arg to canonicalize.
3370         (region_model::loop_replay_fixup): New.
3371         (poisoned_value_diagnostic::emit): Tweak wording of warnings.
3372         (region_model::check_for_poison): Delete.
3373         (region_model::get_gassign_result): New.
3374         (region_model::on_assignment): Port to store-based implementation.
3375         (region_model::on_call_pre): Delete calls to check_for_poison.
3376         Move implementations to region-model-impl-calls.c and port to
3377         store-based implementation.
3378         (region_model::on_call_post): Likewise.
3379         (class reachable_regions): Move to region-model-reachability.h/cc
3380         and port to store-based implementation.
3381         (region_model::handle_unrecognized_call): Port to store-based
3382         implementation.
3383         (region_model::get_reachable_svalues): New.
3384         (region_model::on_setjmp): Port to store-based implementation.
3385         (region_model::on_longjmp): Likewise.
3386         (region_model::handle_phi): Drop is_back_edge param and the logic
3387         using it.
3388         (region_model::get_lvalue_1): Port from region_id to const region *.
3389         (region_model::make_region_for_unexpected_tree_code): Delete.
3390         (assert_compat_types): If the check fails, use internal_error to
3391         show the types.
3392         (region_model::get_lvalue): Port from region_id to const region *.
3393         (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
3394         (region_model::get_rvalue): Likewise.
3395         (region_model::get_or_create_ptr_svalue): Delete.
3396         (region_model::get_or_create_constant_svalue): Delete.
3397         (region_model::get_svalue_for_fndecl): Delete.
3398         (region_model::get_region_for_fndecl): Delete.
3399         (region_model::get_svalue_for_label): Delete.
3400         (region_model::get_region_for_label): Delete.
3401         (build_cast): Delete.
3402         (region_model::maybe_cast_1): Delete.
3403         (region_model::maybe_cast): Delete.
3404         (region_model::get_field_region): Delete.
3405         (region_model::get_store_value): New.
3406         (region_model::region_exists_p): New.
3407         (region_model::deref_rvalue): Port from svalue_id to const svalue *.
3408         (region_model::set_value): Likewise.
3409         (region_model::clobber_region): New.
3410         (region_model::purge_region): New.
3411         (region_model::zero_fill_region): New.
3412         (region_model::mark_region_as_unknown): New.
3413         (region_model::eval_condition): Port from svalue_id to
3414         const svalue *.
3415         (region_model::eval_condition_without_cm): Likewise.
3416         (region_model::compare_initial_and_pointer): New.
3417         (region_model::add_constraint): Port from svalue_id to
3418         const svalue *.
3419         (region_model::maybe_get_constant): Delete.
3420         (region_model::get_representative_path_var): New.
3421         (region_model::add_new_malloc_region): Delete.
3422         (region_model::get_representative_tree): Port to const svalue *.
3423         (region_model::get_representative_path_var): Port to
3424         const region *.
3425         (region_model::get_path_vars_for_svalue): Delete.
3426         (region_model::set_to_new_unknown_value): Delete.
3427         (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
3428         (region_model::update_for_call_superedge): Port from svalue_id to
3429         const svalue *.
3430         (region_model::update_for_return_superedge): Port to store-based
3431         implementation.
3432         (region_model::update_for_call_summary): Replace
3433         set_to_new_unknown_value with mark_region_as_unknown.
3434         (region_model::get_root_region): Delete.
3435         (region_model::get_stack_region_id): Delete.
3436         (region_model::push_frame): Delete.
3437         (region_model::get_current_frame_id): Delete.
3438         (region_model::get_current_function): Delete.
3439         (region_model::pop_frame): Delete.
3440         (region_model::on_top_level_param): New.
3441         (region_model::get_stack_depth): Delete.
3442         (region_model::get_function_at_depth): Delete.
3443         (region_model::get_globals_region_id): Delete.
3444         (region_model::add_svalue): Delete.
3445         (region_model::replace_svalue): Delete.
3446         (region_model::add_region): Delete.
3447         (region_model::get_svalue): Delete.
3448         (region_model::get_region): Delete.
3449         (make_region_for_type): Delete.
3450         (region_model::add_region_for_type): Delete.
3451         (region_model::on_top_level_param): New.
3452         (class restrict_to_used_svalues): Delete.
3453         (region_model::purge_unused_svalues): Delete.
3454         (region_model::push_frame): New.
3455         (region_model::remap_svalue_ids): Delete.
3456         (region_model::remap_region_ids): Delete.
3457         (region_model::purge_regions): Delete.
3458         (region_model::get_descendents): Delete.
3459         (region_model::delete_region_and_descendents): Delete.
3460         (region_model::poison_any_pointers_to_bad_regions): Delete.
3461         (region_model::can_merge_with_p): Delete.
3462         (region_model::get_current_function): New.
3463         (region_model::get_value_by_name): Delete.
3464         (region_model::convert_byte_offset_to_array_index): Delete.
3465         (region_model::pop_frame): New.
3466         (region_model::get_or_create_mem_ref): Delete.
3467         (region_model::get_stack_depth): New.
3468         (region_model::get_frame_at_index): New.
3469         (region_model::unbind_region_and_descendents): New.
3470         (struct bad_pointer_finder): New.
3471         (region_model::get_or_create_pointer_plus_expr): Delete.
3472         (region_model::poison_any_pointers_to_descendents): New.
3473         (region_model::get_or_create_view): Delete.
3474         (region_model::can_merge_with_p): New.
3475         (region_model::get_fndecl_for_call):  Port from svalue_id to
3476         const svalue *.
3477         (struct append_ssa_names_cb_data): New.
3478         (get_ssa_name_regions_for_current_frame): New.
3479         (region_model::append_ssa_names_cb): New.
3480         (model_merger::dump_to_pp): Add "simple" param.  Drop dumping of
3481         remappings.
3482         (model_merger::dump): Add "simple" param to both overloads.
3483         (model_merger::can_merge_values_p): Delete.
3484         (model_merger::record_regions): Delete.
3485         (model_merger::record_svalues): Delete.
3486         (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
3487         (svalue_id_merger_mapping::dump_to_pp): Delete.
3488         (svalue_id_merger_mapping::dump): Delete.
3489         (region_model::create_region_for_heap_alloc): New.
3490         (region_model::create_region_for_alloca): New.
3491         (region_model::record_dynamic_extents): New.
3492         (canonicalization::canonicalization): Delete.
3493         (canonicalization::walk_rid): Delete.
3494         (canonicalization::walk_sid): Delete.
3495         (canonicalization::dump_to_pp): Delete.
3496         (canonicalization::dump): Delete.
3497         (inchash::add): Delete overloads for svalue_id and region_id.
3498         (engine::log_stats): New.
3499         (assert_condition): Add overload comparing svalues.
3500         (assert_dump_eq): Pass "true" for multiline.
3501         (selftest::test_dump): Update for rewrite of region_model.
3502         (selftest::test_dump_2): Rename to...
3503         (selftest::test_struct): ...this.  Provide a region_model_manager
3504         when creating region_model instance.  Remove dump test.  Add
3505         checks for get_offset.
3506         (selftest::test_dump_3): Rename to...
3507         (selftest::test_array_1): ...this.  Provide a region_model_manager
3508         when creating region_model instance.  Remove dump test.
3509         (selftest::test_get_representative_tree): Port from svalue_id to
3510         new API.  Add test coverage for various expressions.
3511         (selftest::test_unique_constants): Provide a region_model_manager
3512         for the region_model.  Add test coverage for comparing const vs
3513         non-const.
3514         (selftest::test_svalue_equality): Delete.
3515         (selftest::test_region_equality): Delete.
3516         (selftest::test_unique_unknowns): New.
3517         (class purge_all_svalue_ids): Delete.
3518         (class purge_one_svalue_id): Delete.
3519         (selftest::test_purging_by_criteria): Delete.
3520         (selftest::test_initial_svalue_folding): New.
3521         (selftest::test_unaryop_svalue_folding): New.
3522         (selftest::test_binop_svalue_folding): New.
3523         (selftest::test_sub_svalue_folding): New.
3524         (selftest::test_purge_unused_svalues): Delete.
3525         (selftest::test_descendent_of_p): New.
3526         (selftest::test_assignment): Provide a region_model_manager for
3527         the region_model.  Drop the dump test.
3528         (selftest::test_compound_assignment): Likewise.
3529         (selftest::test_stack_frames): Port to new implementation.
3530         (selftest::test_get_representative_path_var): Likewise.
3531         (selftest::test_canonicalization_1): Rename to...
3532         (selftest::test_equality_1): ...this.  Port to new API, and add
3533         (selftest::test_canonicalization_2): Provide a
3534         region_model_manager when creating region_model instances.
3535         Remove redundant canicalization.
3536         (selftest::test_canonicalization_3): Provide a
3537         region_model_manager when creating region_model instances.
3538         Remove param from calls to region_model::canonicalize.
3539         (selftest::test_canonicalization_4): Likewise.
3540         (selftest::assert_region_models_merge): Constify
3541         out_merged_svalue.  Port to new API.
3542         (selftest::test_state_merging): Provide a
3543         region_model_manager when creating region_model instances.
3544         Provide a program_point point when merging them.  Replace
3545         set_to_new_unknown_value with usage of placeholder_svalues.
3546         Drop get_value_by_name.  Port from svalue_id to const svalue *.
3547         Add test of heap allocation.
3548         (selftest::test_constraint_merging):  Provide a
3549         region_model_manager when creating region_model instances.
3550         Provide a program_point point when merging them.  Eliminate use
3551         of set_to_new_unknown_value.
3552         (selftest::test_widening_constraints): New.
3553         (selftest::test_iteration_1): New.
3554         (selftest::test_malloc_constraints): Port to store-based
3555         implementation.
3556         (selftest::test_var): New test.
3557         (selftest::test_array_2): New test.
3558         (selftest::test_mem_ref): New test.
3559         (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
3560         (selftest::test_malloc): New.
3561         (selftest::test_alloca): New.
3562         (selftest::analyzer_region_model_cc_tests): Update for renamings.
3563         Call new functions.
3564         * region-model.h (class path_var): Move to analyzer.h.
3565         (class svalue_id): Delete.
3566         (class region_id): Delete.
3567         (class id_map): Delete.
3568         (svalue_id_map): Delete.
3569         (region_id_map): Delete.
3570         (id_map<T>::id_map): Delete.
3571         (id_map<T>::put): Delete.
3572         (id_map<T>::get_dst_for_src): Delete.
3573         (id_map<T>::get_src_for_dst): Delete.
3574         (id_map<T>::dump_to_pp): Delete.
3575         (id_map<T>::dump): Delete.
3576         (id_map<T>::update): Delete.
3577         (one_way_svalue_id_map): Delete.
3578         (one_way_region_id_map): Delete.
3579         (class region_id_set): Delete.
3580         (class svalue_id_set): Delete.
3581         (struct complexity): New.
3582         (class visitor): New.
3583         (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
3584         SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
3585         SK_COMPOUND, and SK_CONJURED.
3586         (svalue::operator==): Delete.
3587         (svalue::operator!=): Delete.
3588         (svalue::clone): Delete.
3589         (svalue::hash): Delete.
3590         (svalue::dump_dot_to_pp): Delete.
3591         (svalue::dump_to_pp): New.
3592         (svalue::dump): New.
3593         (svalue::get_desc): New.
3594         (svalue::dyn_cast_initial_svalue): New.
3595         (svalue::dyn_cast_unaryop_svalue): New.
3596         (svalue::dyn_cast_binop_svalue): New.
3597         (svalue::dyn_cast_sub_svalue): New.
3598         (svalue::dyn_cast_unmergeable_svalue): New.
3599         (svalue::dyn_cast_widening_svalue): New.
3600         (svalue::dyn_cast_compound_svalue): New.
3601         (svalue::dyn_cast_conjured_svalue): New.
3602         (svalue::maybe_undo_cast): New.
3603         (svalue::unwrap_any_unmergeable): New.
3604         (svalue::remap_region_ids): Delete
3605         (svalue::can_merge_p): New.
3606         (svalue::walk_for_canonicalization): Delete
3607         (svalue::get_complexity): New.
3608         (svalue::get_child_sid): Delete
3609         (svalue::accept): New.
3610         (svalue::live_p): New.
3611         (svalue::implicitly_live_p): New.
3612         (svalue::svalue): Add complexity param.
3613         (svalue::add_to_hash): Delete
3614         (svalue::print_details): Delete
3615         (svalue::m_complexity): New field.
3616         (region_svalue::key_t): New struct.
3617         (region_svalue::region_svalue): Port from region_id to
3618         const region_id *.  Add complexity.
3619         (region_svalue::compare_fields): Delete.
3620         (region_svalue::clone): Delete.
3621         (region_svalue::dump_dot_to_pp): Delete.
3622         (region_svalue::get_pointee): Port from region_id to
3623         const region_id *.
3624         (region_svalue::remap_region_ids): Delete.
3625         (region_svalue::merge_values): Delete.
3626         (region_svalue::dump_to_pp): New.
3627         (region_svalue::accept): New.
3628         (region_svalue::walk_for_canonicalization): Delete.
3629         (region_svalue::eval_condition): Make params const.
3630         (region_svalue::add_to_hash): Delete.
3631         (region_svalue::print_details): Delete.
3632         (region_svalue::m_rid): Replace with...
3633         (region_svalue::m_reg): ...this.
3634         (is_a_helper <region_svalue *>::test): Convert to...
3635         (is_a_helper <const region_svalue *>::test): ...this.
3636         (template <> struct default_hash_traits<region_svalue::key_t>):
3637         New.
3638         (constant_svalue::constant_svalue): Add complexity.
3639         (constant_svalue::compare_fields): Delete.
3640         (constant_svalue::clone): Delete.
3641         (constant_svalue::add_to_hash): Delete.
3642         (constant_svalue::dump_to_pp): New.
3643         (constant_svalue::accept): New.
3644         (constant_svalue::implicitly_live_p): New.
3645         (constant_svalue::merge_values): Delete.
3646         (constant_svalue::eval_condition): Make params const.
3647         (constant_svalue::get_child_sid): Delete.
3648         (constant_svalue::print_details): Delete.
3649         (is_a_helper <constant_svalue *>::test): Convert to...
3650         (is_a_helper <const constant_svalue *>::test): ...this.
3651         (class unknown_svalue): Update leading comment.
3652         (unknown_svalue::unknown_svalue): Add complexity.
3653         (unknown_svalue::compare_fields): Delete.
3654         (unknown_svalue::add_to_hash): Delete.
3655         (unknown_svalue::dyn_cast_unknown_svalue): Delete.
3656         (unknown_svalue::print_details): Delete.
3657         (unknown_svalue::dump_to_pp): New.
3658         (unknown_svalue::accept): New.
3659         (poisoned_svalue::key_t): New struct.
3660         (poisoned_svalue::poisoned_svalue): Add complexity.
3661         (poisoned_svalue::compare_fields): Delete.
3662         (poisoned_svalue::clone): Delete.
3663         (poisoned_svalue::add_to_hash): Delete.
3664         (poisoned_svalue::dump_to_pp): New.
3665         (poisoned_svalue::accept): New.
3666         (poisoned_svalue::print_details): Delete.
3667         (is_a_helper <poisoned_svalue *>::test): Convert to...
3668         (is_a_helper <const poisoned_svalue *>::test): ...this.
3669         (template <> struct default_hash_traits<poisoned_svalue::key_t>):
3670         New.
3671         (setjmp_record::add_to_hash): New.
3672         (setjmp_svalue::key_t): New struct.
3673         (setjmp_svalue::compare_fields): Delete.
3674         (setjmp_svalue::clone): Delete.
3675         (setjmp_svalue::add_to_hash): Delete.
3676         (setjmp_svalue::setjmp_svalue): Add complexity.
3677         (setjmp_svalue::dump_to_pp): New.
3678         (setjmp_svalue::accept): New.
3679         (setjmp_svalue::void print_details): Delete.
3680         (is_a_helper <const setjmp_svalue *>::test): New.
3681         (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
3682         (class initial_svalue : public svalue): New.
3683         (is_a_helper <const initial_svalue *>::test): New.
3684         (class unaryop_svalue): New.
3685         (is_a_helper <const unaryop_svalue *>::test): New.
3686         (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
3687         (class binop_svalue): New.
3688         (is_a_helper <const binop_svalue *>::test): New.
3689         (template <> struct default_hash_traits<binop_svalue::key_t>): New.
3690         (class sub_svalue): New.
3691         (is_a_helper <const sub_svalue *>::test): New.
3692         (template <> struct default_hash_traits<sub_svalue::key_t>): New.
3693         (class unmergeable_svalue): New.
3694         (is_a_helper <const unmergeable_svalue *>::test): New.
3695         (class placeholder_svalue): New.
3696         (is_a_helper <placeholder_svalue *>::test): New.
3697         (class widening_svalue): New.
3698         (is_a_helper <widening_svalue *>::test): New.
3699         (template <> struct default_hash_traits<widening_svalue::key_t>): New.
3700         (class compound_svalue): New.
3701         (is_a_helper <compound_svalue *>::test): New.
3702         (template <> struct default_hash_traits<compound_svalue::key_t>): New.
3703         (class conjured_svalue): New.
3704         (is_a_helper <conjured_svalue *>::test): New.
3705         (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
3706         (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
3707         RK_ARRAY.  Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
3708         RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
3709         (region_kind_to_str): Delete.
3710         (region::~region): Move implementation to region.cc.
3711         (region::operator==): Delete.
3712         (region::operator!=): Delete.
3713         (region::clone): Delete.
3714         (region::get_id): New.
3715         (region::cmp_ids): New.
3716         (region::dyn_cast_map_region): Delete.
3717         (region::dyn_cast_array_region): Delete.
3718         (region::region_id get_parent): Delete.
3719         (region::get_parent_region): Convert to a simple accessor.
3720         (region::void set_value): Delete.
3721         (region::svalue_id get_value): Delete.
3722         (region::svalue_id get_value_direct): Delete.
3723         (region::svalue_id get_inherited_child_sid): Delete.
3724         (region::dyn_cast_frame_region): New.
3725         (region::dyn_cast_function_region): New.
3726         (region::dyn_cast_decl_region): New.
3727         (region::dyn_cast_field_region): New.
3728         (region::dyn_cast_element_region): New.
3729         (region::dyn_cast_offset_region): New.
3730         (region::dyn_cast_cast_region): New.
3731         (region::dyn_cast_string_region): New.
3732         (region::accept): New.
3733         (region::get_base_region): New.
3734         (region::base_region_p): New.
3735         (region::descendent_of_p): New.
3736         (region::maybe_get_frame_region): New.
3737         (region::maybe_get_decl): New.
3738         (region::hash): Delete.
3739         (region::rint): Delete.
3740         (region::dump_dot_to_pp): Delete.
3741         (region::get_desc): New.
3742         (region::dump_to_pp): Convert to vfunc, changing signature.
3743         (region::dump_child_label): Delete.
3744         (region::remap_svalue_ids): Delete.
3745         (region::remap_region_ids): Delete.
3746         (region::dump): New.
3747         (region::walk_for_canonicalization): Delete.
3748         (region::non_null_p): Drop region_model param.
3749         (region::add_view): Delete.
3750         (region::get_view): Delete.
3751         (region::get_active_view): Delete.
3752         (region::is_view_p): Delete.
3753         (region::cmp_ptrs): New.
3754         (region::validate): Delete.
3755         (region::get_offset): New.
3756         (region::get_byte_size): New.
3757         (region::get_bit_size): New.
3758         (region::get_subregions_for_binding): New.
3759         (region::region): Add complexity param.  Convert parent from
3760         region_id to const region *.  Drop svalue_id.  Drop copy ctor.
3761         (region::symbolic_for_unknown_ptr_p): New.
3762         (region::add_to_hash): Delete.
3763         (region::print_fields): Delete.
3764         (region::get_complexity): New accessor.
3765         (region::become_active_view): Delete.
3766         (region::deactivate_any_active_view): Delete.
3767         (region::deactivate_view): Delete.
3768         (region::calc_offset): New.
3769         (region::m_parent_rid): Delete.
3770         (region::m_sval_id): Delete.
3771         (region::m_complexity): New.
3772         (region::m_id): New.
3773         (region::m_parent): New.
3774         (region::m_view_rids): Delete.
3775         (region::m_is_view): Delete.
3776         (region::m_active_view_rid): Delete.
3777         (region::m_cached_offset): New.
3778         (is_a_helper <region *>::test): Convert to...
3779         (is_a_helper <const region *>::test): ... this.
3780         (class primitive_region): Delete.
3781         (class space_region): New.
3782         (class map_region): Delete.
3783         (is_a_helper <map_region *>::test): Delete.
3784         (class frame_region): Reimplement.
3785         (template <> struct default_hash_traits<frame_region::key_t>):
3786         New.
3787         (class globals_region): Reimplement.
3788         (is_a_helper <globals_region *>::test): Convert to...
3789         (is_a_helper <const globals_region *>::test): ...this.
3790         (class struct_or_union_region): Delete.
3791         (is_a_helper <struct_or_union_region *>::test): Delete.
3792         (class code_region): Reimplement.
3793         (is_a_helper <const code_region *>::test): New.
3794         (class struct_region): Delete.
3795         (is_a_helper <struct_region *>::test): Delete.
3796         (class function_region): Reimplement.
3797         (is_a_helper <function_region *>::test): Convert to...
3798         (is_a_helper <const function_region *>::test): ...this.
3799         (class union_region): Delete.
3800         (is_a_helper <union_region *>::test): Delete.
3801         (class label_region): New.
3802         (is_a_helper <const label_region *>::test): New.
3803         (class scope_region): Delete.
3804         (class stack_region): Reimplement.
3805         (is_a_helper <stack_region *>::test): Convert to...
3806         (is_a_helper <const stack_region *>::test): ...this.
3807         (class heap_region): Reimplement.
3808         (is_a_helper <heap_region *>::test): Convert to...
3809         (is_a_helper <const heap_region *>::test): ...this.
3810         (class root_region): Reimplement.
3811         (is_a_helper <root_region *>::test): Convert to...
3812         (is_a_helper <const root_region *>::test): ...this.
3813         (class symbolic_region): Reimplement.
3814         (is_a_helper <const symbolic_region *>::test): New.
3815         (template <> struct default_hash_traits<symbolic_region::key_t>):
3816         New.
3817         (class decl_region): New.
3818         (is_a_helper <const decl_region *>::test): New.
3819         (class field_region): New.
3820         (template <> struct default_hash_traits<field_region::key_t>): New.
3821         (class array_region): Delete.
3822         (class element_region): New.
3823         (is_a_helper <array_region *>::test): Delete.
3824         (is_a_helper <const element_region *>::test): New.
3825         (template <> struct default_hash_traits<element_region::key_t>):
3826         New.
3827         (class offset_region): New.
3828         (is_a_helper <const offset_region *>::test): New.
3829         (template <> struct default_hash_traits<offset_region::key_t>):
3830         New.
3831         (class cast_region): New.
3832         (is_a_helper <const cast_region *>::test): New.
3833         (template <> struct default_hash_traits<cast_region::key_t>): New.
3834         (class heap_allocated_region): New.
3835         (class alloca_region): New.
3836         (class string_region): New.
3837         (is_a_helper <const string_region *>::test): New.
3838         (class unknown_region): New.
3839         (class region_model_manager): New.
3840         (struct append_ssa_names_cb_data): New.
3841         (class call_details): New.
3842         (region_model::region_model): Add region_model_manager param.
3843         (region_model::print_svalue): Delete.
3844         (region_model::dump_dot_to_pp): Delete.
3845         (region_model::dump_dot_to_file): Delete.
3846         (region_model::dump_dot): Delete.
3847         (region_model::dump_to_pp): Drop summarize param in favor of
3848         simple and multiline.
3849         (region_model::dump): Likewise.
3850         (region_model::summarize_to_pp): Delete.
3851         (region_model::summarize): Delete.
3852         (region_model::void canonicalize): Drop ctxt param.
3853         (region_model::void check_for_poison): Delete.
3854         (region_model::get_gassign_result): New.
3855         (region_model::impl_call_alloca): New.
3856         (region_model::impl_call_analyzer_describe): New.
3857         (region_model::impl_call_analyzer_eval): New.
3858         (region_model::impl_call_builtin_expect): New.
3859         (region_model::impl_call_calloc): New.
3860         (region_model::impl_call_free): New.
3861         (region_model::impl_call_malloc): New.
3862         (region_model::impl_call_memset): New.
3863         (region_model::impl_call_strlen): New.
3864         (region_model::get_reachable_svalues): New.
3865         (region_model::handle_phi): Drop is_back_edge param.
3866         (region_model::region_id get_root_rid): Delete.
3867         (region_model::root_region *get_root_region): Delete.
3868         (region_model::region_id get_stack_region_id): Delete.
3869         (region_model::push_frame): Convert from region_id and svalue_id
3870         to const region * and const svalue *.
3871         (region_model::get_current_frame_id): Replace with...
3872         (region_model::get_current_frame): ...this.
3873         (region_model::pop_frame): Convert from region_id to
3874         const region *.  Drop purge and stats param.  Add out_result.
3875         (region_model::function *get_function_at_depth): Delete.
3876         (region_model::get_globals_region_id): Delete.
3877         (region_model::add_svalue): Delete.
3878         (region_model::replace_svalue): Delete.
3879         (region_model::add_region): Delete.
3880         (region_model::add_region_for_type): Delete.
3881         (region_model::get_svalue): Delete.
3882         (region_model::get_region): Delete.
3883         (region_model::get_lvalue): Convert from region_id to
3884         const region *.
3885         (region_model::get_rvalue): Convert from svalue_id to
3886         const svalue *.
3887         (region_model::get_or_create_ptr_svalue): Delete.
3888         (region_model::get_or_create_constant_svalue): Delete.
3889         (region_model::get_svalue_for_fndecl): Delete.
3890         (region_model::get_svalue_for_label): Delete.
3891         (region_model::get_region_for_fndecl): Delete.
3892         (region_model::get_region_for_label): Delete.
3893         (region_model::get_frame_at_index (int index) const;): New.
3894         (region_model::maybe_cast): Delete.
3895         (region_model::maybe_cast_1): Delete.
3896         (region_model::get_field_region): Delete.
3897         (region_model::id deref_rvalue): Convert from region_id and
3898         svalue_id to const region * and const svalue *.  Drop overload,
3899         passing in both a tree and an svalue.
3900         (region_model::set_value): Convert from region_id and svalue_id to
3901         const region * and const svalue *.
3902         (region_model::set_to_new_unknown_value): Delete.
3903         (region_model::clobber_region (const region *reg);): New.
3904         (region_model::purge_region (const region *reg);): New.
3905         (region_model::zero_fill_region (const region *reg);): New.
3906         (region_model::mark_region_as_unknown (const region *reg);): New.
3907         (region_model::copy_region): Convert from region_id to
3908         const region *.
3909         (region_model::eval_condition): Convert from svalue_id to
3910         const svalue *.
3911         (region_model::eval_condition_without_cm): Likewise.
3912         (region_model::compare_initial_and_pointer): New.
3913         (region_model:maybe_get_constant): Delete.
3914         (region_model::add_new_malloc_region): Delete.
3915         (region_model::get_representative_tree): Convert from svalue_id to
3916         const svalue *.
3917         (region_model::get_representative_path_var): Delete decl taking a
3918         region_id in favor of two decls, for svalue vs region, with an
3919         svalue_set to ensure termination.
3920         (region_model::get_path_vars_for_svalue): Delete.
3921         (region_model::create_region_for_heap_alloc): New.
3922         (region_model::create_region_for_alloca): New.
3923         (region_model::purge_unused_svalues): Delete.
3924         (region_model::remap_svalue_ids): Delete.
3925         (region_model::remap_region_ids): Delete.
3926         (region_model::purge_regions): Delete.
3927         (region_model::get_num_svalues): Delete.
3928         (region_model::get_num_regions): Delete.
3929         (region_model::get_descendents): Delete.
3930         (region_model::get_store): New.
3931         (region_model::delete_region_and_descendents): Delete.
3932         (region_model::get_manager): New.
3933         (region_model::unbind_region_and_descendents): New.
3934         (region_model::can_merge_with_p): Add point param.  Drop
3935         svalue_id_merger_mapping.
3936         (region_model::get_value_by_name): Delete.
3937         (region_model::convert_byte_offset_to_array_index): Delete.
3938         (region_model::get_or_create_mem_ref): Delete.
3939         (region_model::get_or_create_pointer_plus_expr): Delete.
3940         (region_model::get_or_create_view): Delete.
3941         (region_model::get_lvalue_1): Convert from region_id to
3942         const region *.
3943         (region_model::get_rvalue_1): Convert from svalue_id to
3944         const svalue *.
3945         (region_model::get_ssa_name_regions_for_current_frame): New.
3946         (region_model::append_ssa_names_cb): New.
3947         (region_model::get_store_value): New.
3948         (region_model::copy_struct_region): Delete.
3949         (region_model::copy_union_region): Delete.
3950         (region_model::copy_array_region): Delete.
3951         (region_model::region_exists_p): New.
3952         (region_model::make_region_for_unexpected_tree_code): Delete.
3953         (region_model::loop_replay_fixup): New.
3954         (region_model::poison_any_pointers_to_bad_regions): Delete.
3955         (region_model::poison_any_pointers_to_descendents): New.
3956         (region_model::dump_summary_of_rep_path_vars): Delete.
3957         (region_model::on_top_level_param): New.
3958         (region_model::record_dynamic_extents): New.
3959         (region_model::m_mgr;): New.
3960         (region_model::m_store;): New.
3961         (region_model::m_svalues;): Delete.
3962         (region_model::m_regions;): Delete.
3963         (region_model::m_root_rid;): Delete.
3964         (region_model::m_current_frame;): New.
3965         (region_model_context::remap_svalue_ids): Delete.
3966         (region_model_context::can_purge_p): Delete.
3967         (region_model_context::on_svalue_leak): New.
3968         (region_model_context::on_svalue_purge): Delete.
3969         (region_model_context::on_liveness_change): New.
3970         (region_model_context::on_inherited_svalue): Delete.
3971         (region_model_context::on_cast): Delete.
3972         (region_model_context::on_unknown_change): Convert from svalue_id to
3973         const svalue * and add is_mutable.
3974         (class noop_region_model_context): Update for region_model_context
3975         changes.
3976         (model_merger::model_merger): Add program_point.  Drop
3977         svalue_id_merger_mapping.
3978         (model_merger::dump_to_pp): Add "simple" param.
3979         (model_merger::dump): Likewise.
3980         (model_merger::get_region_a): Delete.
3981         (model_merger::get_region_b): Delete.
3982         (model_merger::can_merge_values_p): Delete.
3983         (model_merger::record_regions): Delete.
3984         (model_merger::record_svalues): Delete.
3985         (model_merger::m_point): New field.
3986         (model_merger::m_map_regions_from_a_to_m): Delete.
3987         (model_merger::m_map_regions_from_b_to_m): Delete.
3988         (model_merger::m_sid_mapping): Delete.
3989         (struct svalue_id_merger_mapping): Delete.
3990         (class engine): New.
3991         (struct canonicalization): Delete.
3992         (inchash::add): Delete decls for hashing svalue_id and region_id.
3993         (test_region_model_context::on_unexpected_tree_code): Require t to
3994         be non-NULL.
3995         (selftest::assert_condition): Add overload comparing a pair of
3996         const svalue *.
3997         * sm-file.cc: Include "tristate.h", "selftest.h",
3998         "analyzer/call-string.h", "analyzer/program-point.h",
3999         "analyzer/store.h", and "analyzer/region-model.h".
4000         (fileptr_state_machine::get_default_state): New.
4001         (fileptr_state_machine::on_stmt): Remove calls to
4002         get_readable_tree in favor of get_diagnostic_tree.
4003         * sm-malloc.cc: Include "tristate.h", "selftest.h",
4004         "analyzer/call-string.h", "analyzer/program-point.h",
4005         "analyzer/store.h", and "analyzer/region-model.h".
4006         (malloc_state_machine::get_default_state): New.
4007         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
4008         (malloc_diagnostic::describe_state_change): Handle change.m_expr
4009         being NULL.
4010         (null_arg::emit): Avoid printing "NULL '0'".
4011         (null_arg::describe_final_event): Avoid printing "(0) NULL".
4012         (malloc_leak::emit): Handle m_arg being NULL.
4013         (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
4014         (malloc_state_machine::on_stmt): Don't call get_readable_tree.
4015         Call get_diagnostic_tree when creating pending diagnostics.
4016         Update for is_zero_assignment becoming a member function of
4017         sm_ctxt.
4018         Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
4019         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
4020         vfunc implementation.
4021         * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
4022         get_diagnostic_tree and pass the result to warn_for_state.
4023         * sm-signal.cc: Move includes of "analyzer/call-string.h" and
4024         "analyzer/program-point.h" to before "analyzer/region-model.h",
4025         and also include "analyzer/store.h" before it.
4026         (signal_unsafe_call::describe_state_change): Use
4027         get_dest_function to get handler.
4028         (update_model_for_signal_handler): Pass manager to region_model
4029         ctor.
4030         (register_signal_handler::impl_transition): Update for changes to
4031         get_or_create_node and add_edge.
4032         * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
4033         get_readable_tree, replacing them when calling warn_for_state with
4034         calls to get_diagnostic_tree.
4035         * sm.cc (is_zero_assignment): Delete.
4036         (any_pointer_p): Move to within namespace ana.
4037         * sm.h (is_zero_assignment): Remove decl.
4038         (any_pointer_p): Move decl to within namespace ana.
4039         (state_machine::get_default_state): New vfunc.
4040         (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
4041         (sm_context::get_readable_tree): Rename to...
4042         (sm_context::get_diagnostic_tree): ...this.
4043         (sm_context::is_zero_assignment): New vfunc.
4044         * store.cc: New file.
4045         * store.h: New file.
4046         * svalue.cc: New file.
4047
4048 2020-05-22  Mark Wielaard  <mark@klomp.org>
4049
4050         * sm-signal.cc(signal_unsafe_call::emit): Possibly add
4051         gcc_rich_location note for replacement.
4052         (signal_unsafe_call::get_replacement_fn): New private function.
4053         (get_async_signal_unsafe_fns): Add "exit".
4054
4055 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
4056
4057         PR analyzer/94816
4058         * engine.cc (impl_region_model_context::on_unexpected_tree_code):
4059         Handle NULL tree.
4060         * region-model.cc (region_model::add_region_for_type): Handle
4061         NULL type.
4062         * region-model.h
4063         (test_region_model_context::on_unexpected_tree_code): Handle NULL
4064         tree.
4065
4066 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
4067
4068         PR analyzer/94447
4069         PR analyzer/94639
4070         PR analyzer/94732
4071         PR analyzer/94754
4072         * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
4073         * program-state.cc (selftest::test_program_state_dumping): Update
4074         expected dump result for removal of "uninit".
4075         * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
4076         case.
4077         (root_region::ensure_stack_region): Initialize stack with null
4078         svalue_id rather than with a typeless POISON_KIND_UNINIT value.
4079         (root_region::ensure_heap_region): Likewise for the heap.
4080         (region_model::dump_summary_of_rep_path_vars): Remove
4081         summarization of uninit values.
4082         (region_model::validate): Remove check that the stack has a
4083         POISON_KIND_UNINIT value.
4084         (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
4085         case.
4086         (poisoned_value_diagnostic::describe_final_event): Likewise.
4087         (selftest::test_dump): Update expected dump result for removal of
4088         "uninit".
4089         (selftest::test_svalue_equality): Remove "uninit" and "freed".
4090         * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
4091
4092 2020-04-01  David Malcolm  <dmalcolm@redhat.com>
4093
4094         PR analyzer/94378
4095         * checker-path.cc: Include "bitmap.h".
4096         * constraint-manager.cc: Likewise.
4097         * diagnostic-manager.cc: Likewise.
4098         * engine.cc: Likewise.
4099         (exploded_node::detect_leaks): Pass null region_id to pop_frame.
4100         * program-point.cc: Include "bitmap.h".
4101         * program-state.cc: Likewise.
4102         * region-model.cc (id_set<region_id>::id_set): Convert to...
4103         (region_id_set::region_id_set): ...this.
4104         (svalue_id_set::svalue_id_set): New ctor.
4105         (region_model::copy_region): New function.
4106         (region_model::copy_struct_region): New function.
4107         (region_model::copy_union_region): New function.
4108         (region_model::copy_array_region): New function.
4109         (stack_region::pop_frame): Drop return value.  Add
4110         "result_dst_rid" param; if it is non-null, use copy_region to copy
4111         the result to it.  Rather than capture and pass a single "known
4112         used" return value to be used by purge_unused_values, instead
4113         gather and pass a set of known used return values.
4114         (root_region::pop_frame): Drop return value.  Add "result_dst_rid"
4115         param.
4116         (region_model::on_assignment): Use copy_region.
4117         (region_model::on_return): Likewise for the result.
4118         (region_model::on_longjmp): Pass null for pop_frame's
4119         result_dst_rid.
4120         (region_model::update_for_return_superedge): Pass the region for the
4121         return value of the call, if any, to pop_frame, rather than setting
4122         the lvalue for the lhs of the result.
4123         (region_model::pop_frame): Drop return value.  Add
4124         "result_dst_rid" param.
4125         (region_model::purge_unused_svalues): Convert third param from an
4126         svalue_id * to an svalue_id_set *, updating the initial populating
4127         of the "used" bitmap accordingly.  Don't remap it when done.
4128         (struct selftest::coord_test): New selftest fixture, extracted from...
4129         (selftest::test_dump_2): ...here.
4130         (selftest::test_compound_assignment): New selftest.
4131         (selftest::test_stack_frames): Pass null to new param of pop_frame.
4132         (selftest::analyzer_region_model_cc_tests): Call the new selftest.
4133         * region-model.h (class id_set): Delete template.
4134         (class region_id_set): Reimplement, using old id_set implementation.
4135         (class svalue_id_set): Likewise.  Convert from auto_sbitmap to
4136         auto_bitmap.
4137         (region::get_active_view): New accessor.
4138         (stack_region::pop_frame): Drop return value.  Add
4139         "result_dst_rid" param.
4140         (root_region::pop_frame): Likewise.
4141         (region_model::pop_frame): Likewise.
4142         (region_model::copy_region): New decl.
4143         (region_model::purge_unused_svalues): Convert third param from an
4144         svalue_id * to an svalue_id_set *.
4145         (region_model::copy_struct_region): New decl.
4146         (region_model::copy_union_region): New decl.
4147         (region_model::copy_array_region): New decl.
4148
4149 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4150
4151         * program-state.cc (selftest::test_program_state_dumping): Update
4152         expected dump to include symbolic_region's possibly_null field.
4153         * region-model.cc (symbolic_region::print_fields): New vfunc
4154         implementation.
4155         (region_model::add_constraint): Clear m_possibly_null from
4156         symbolic_regions now known to be non-NULL.
4157         (selftest::test_malloc_constraints): New selftest.
4158         (selftest::analyzer_region_model_cc_tests): Call it.
4159         * region-model.h (region::dyn_cast_symbolic_region): Add non-const
4160         overload.
4161         (symbolic_region::dyn_cast_symbolic_region): Implement it.
4162         (symbolic_region::print_fields): New vfunc override decl.
4163
4164 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4165
4166         * analyzer.h (class feasibility_problem): New forward decl.
4167         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4168         Initialize new fields m_status, m_epath_length, and m_problem.
4169         (saved_diagnostic::~saved_diagnostic): Delete m_problem.
4170         (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
4171         const ref to a mutable ptr.
4172         (dedupe_winners::add): Convert "sd" param from a const ref to a
4173         mutable ptr.  Record the length of the exploded_path.  Record the
4174         feasibility/infeasibility of sd into sd, capturing a
4175         feasibility_problem when feasible_p fails, and storing it in sd.
4176         (diagnostic_manager::emit_saved_diagnostics): Update for pass by
4177         ptr rather than by const ref.
4178         * diagnostic-manager.h (class saved_diagnostic): Add new enum
4179         status.  Add fields m_status, m_epath_length and m_problem.
4180         (saved_diagnostic::set_feasible): New member function.
4181         (saved_diagnostic::set_infeasible): New member function.
4182         (saved_diagnostic::get_feasibility_problem): New accessor.
4183         (saved_diagnostic::get_status): New accessor.
4184         (saved_diagnostic::set_epath_length): New member function.
4185         (saved_diagnostic::get_epath_length): New accessor.
4186         * engine.cc: Include "gimple-pretty-print.h".
4187         (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
4188         a new feasibility_problem to it on failure.
4189         (viz_callgraph_node::dump_dot): Convert begin_tr calls to
4190         begin_trtd.  Convert end_tr calls to end_tdtr.
4191         (class exploded_graph_annotator): New subclass of dot_annotator.
4192         (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
4193         after the analysis runs, using exploded_graph_annotator. dumping
4194         to DUMP_BASE_NAME.supergraph-eg.dot.
4195         * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
4196         public.
4197         (exploded_path::feasible_p): Add OUT param.
4198         (class feasibility_problem): New class.
4199         * state-purge.cc (state_purge_annotator::add_node_annotations):
4200         Return a bool, add a "within_table" param.
4201         (print_vec_of_names): Convert begin_tr calls to begin_trtd.
4202         Convert end_tr calls to end_tdtr.
4203         (state_purge_annotator::add_stmt_annotations): Add "within_row"
4204         param.
4205         * state-purge.h ((state_purge_annotator::add_node_annotations):
4206         Return a bool, add a "within_table" param.
4207         (state_purge_annotator::add_stmt_annotations): Add "within_row"
4208         param.
4209         * supergraph.cc (supernode::dump_dot): Call add_node_annotations
4210         twice: as before, passing false for "within_table", then again
4211         with true when within the TABLE element.  Convert some begin_tr
4212         calls to begin_trtd, and some end_tr calls to end_tdtr.
4213         Repeat each add_stmt_annotations call, distinguishing between
4214         calls that add TRs and those that add TDs to an existing TR.
4215         Add a call to add_after_node_annotations.
4216         * supergraph.h (dot_annotator::add_node_annotations): Add a
4217         "within_table" param.
4218         (dot_annotator::add_stmt_annotations): Add a "within_row" param.
4219         (dot_annotator::add_after_node_annotations): New vfunc.
4220
4221 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4222
4223         * diagnostic-manager.cc (dedupe_winners::add): Show the
4224         exploded_node index in the log messages.
4225         (diagnostic_manager::emit_saved_diagnostics): Log a summary of
4226         m_saved_diagnostics at entry.
4227
4228 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
4229
4230         * supergraph.cc (superedge::dump): Add space before description;
4231         move newline to non-pretty_printer overload.
4232
4233 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
4234
4235         * region-model.cc: Include "stor-layout.h".
4236         (region_model::dump_to_pp): Rather than calling
4237         dump_summary_of_map on each of the current frame and the globals,
4238         instead get a vec of representative path_vars for all regions,
4239         and then dump a summary of all of them.
4240         (region_model::dump_summary_of_map): Delete, rewriting into...
4241         (region_model::dump_summary_of_rep_path_vars): ...this new
4242         function, working on a vec of path_vars.
4243         (region_model::set_value): New overload.
4244         (region_model::get_representative_path_var): Rename
4245         "parent_region" local to "parent_reg" and consolidate with other
4246         local.  Guard test for grandparent being stack on parent_reg being
4247         non-NULL.  Move handling for parent being an array_region to
4248         within guard for parent_reg being non-NULL.
4249         (selftest::make_test_compound_type): New function.
4250         (selftest::test_dump_2): New selftest.
4251         (selftest::test_dump_3): New selftest.
4252         (selftest::test_stack_frames): Update expected output from
4253         simplified dump to show "a" and "b" from parent frame and "y" in
4254         child frame.
4255         (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
4256         test_dump_3.
4257         * region-model.h (region_model::set_value): New overload decl.
4258         (region_model::dump_summary_of_map): Delete.
4259         (region_model::dump_summary_of_rep_path_vars): New.
4260
4261 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
4262
4263         * region-model.h (class noop_region_model_context): New subclass
4264         of region_model_context.
4265         (class tentative_region_model_context): Inherit from
4266         noop_region_model_context rather than from region_model_context;
4267         drop redundant vfunc implementations.
4268         (class test_region_model_context): Likewise.
4269
4270 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
4271
4272         * engine.cc (exploded_node::exploded_node): Move implementation
4273         here from header; accept point_and_state by const reference rather
4274         than by value.
4275         * exploded-graph.h (exploded_node::exploded_node): Pass
4276         point_and_state by const reference rather than by value.  Move
4277         body to engine.cc.
4278
4279 2020-03-18  Jakub Jelinek  <jakub@redhat.com>
4280
4281         * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
4282         issue in a comment.
4283         * region-model.cc (region_model::make_region_for_unexpected_tree_code,
4284         region_model::delete_region_and_descendents): Likewise.
4285         * engine.cc (class exploded_cluster): Likewise.
4286         * diagnostic-manager.cc (class path_builder): Likewise.
4287
4288 2020-03-13  David Malcolm  <dmalcolm@redhat.com>
4289
4290         PR analyzer/94099
4291         PR analyzer/94105
4292         * diagnostic-manager.cc (for_each_state_change): Bulletproof
4293         against errors in get_rvalue by passing a
4294         tentative_region_model_context and rejecting if there's an error.
4295         * region-model.cc (region_model::get_lvalue_1): When handling
4296         ARRAY_REF, handle results of error-handling.  Handle NOP_EXPR.
4297
4298 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
4299
4300         * analyzer.h (class array_region): New forward decl.
4301         * program-state.cc (selftest::test_program_state_dumping_2): New.
4302         (selftest::analyzer_program_state_cc_tests): Call it.
4303         * region-model.cc (array_region::constant_from_key): New.
4304         (region_model::get_representative_tree): Handle region_svalue by
4305         generating an ADDR_EXPR.
4306         (region_model::get_representative_path_var): In view handling,
4307         remove erroneous TREE_TYPE when determining the type of the tree.
4308         Handle array regions and STRING_CST.
4309         (selftest::assert_dump_tree_eq): New.
4310         (ASSERT_DUMP_TREE_EQ): New macro.
4311         (selftest::test_get_representative_tree): New selftest.
4312         (selftest::analyzer_region_model_cc_tests): Call it.
4313         * region-model.h (region::dyn_cast_array_region): New vfunc.
4314         (array_region::dyn_cast_array_region): New vfunc implementation.
4315         (array_region::constant_from_key): New decl.
4316
4317 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
4318
4319         * analyzer.h (dump_quoted_tree): New decl.
4320         * engine.cc (exploded_node::dump_dot): Pass region model to
4321         sm_state_map::print.
4322         * program-state.cc: Include diagnostic-core.h.
4323         (sm_state_map::print): Add "model" param and use it to print
4324         representative trees.  Only print origin information if non-null.
4325         (sm_state_map::dump): Pass NULL for model to print call.
4326         (program_state::print): Pass region model to sm_state_map::print.
4327         (program_state::dump_to_pp): Use spaces rather than newlines when
4328         summarizing.  Pass region_model to sm_state_map::print.
4329         (ana::selftest::assert_dump_eq): New function.
4330         (ASSERT_DUMP_EQ): New macro.
4331         (ana::selftest::test_program_state_dumping): New function.
4332         (ana::selftest::analyzer_program_state_cc_tests): Call it.
4333         * program-state.h (program_state::print): Add model param.
4334         * region-model.cc (dump_quoted_tree): New function.
4335         (map_region::print_fields): Use dump_quoted_tree rather than
4336         %qE to avoid lang-dependent output.
4337         (map_region::dump_child_label): Likewise.
4338         (region_model::dump_summary_of_map): For SK_REGION, when
4339         get_representative_path_var fails, print the region id rather than
4340         erroneously printing NULL.
4341         * sm.cc (state_machine::get_state_by_name): New function.
4342         * sm.h (state_machine::get_state_by_name): New decl.
4343
4344 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
4345
4346         * region-model.cc (region::validate): Convert model param from ptr
4347         to reference.  Update comment to reflect that it's now a vfunc.
4348         (map_region::validate): New vfunc implementation.
4349         (array_region::validate): New vfunc implementation.
4350         (stack_region::validate): New vfunc implementation.
4351         (root_region::validate): New vfunc implementation.
4352         (region_model::validate): Pass a reference rather than a pointer
4353         to the region::validate vfunc.
4354         * region-model.h (region::validate): Make virtual.  Convert model
4355         param from ptr to reference.
4356         (map_region::validate): New vfunc decl.
4357         (array_region::validate): New vfunc decl.
4358         (stack_region::validate): New vfunc decl.
4359         (root_region::validate): New vfunc decl.
4360
4361 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
4362
4363         PR analyzer/93993
4364         * region-model.cc (region_model::on_call_pre): Handle
4365         BUILT_IN_EXPECT and its variants.
4366         (region_model::add_any_constraints_from_ssa_def_stmt): Split out
4367         gassign handling into add_any_constraints_from_gassign; add gcall
4368         handling.
4369         (region_model::add_any_constraints_from_gassign): New function,
4370         based on the above.  Add handling for NOP_EXPR.
4371         (region_model::add_any_constraints_from_gcall): New function.
4372         (region_model::get_representative_path_var): Handle views.
4373         * region-model.h
4374         (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
4375         (region_model::add_any_constraints_from_gassign): New decl.
4376
4377 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
4378
4379         PR analyzer/93993
4380         * checker-path.h (state_change_event::get_lvalue): Add ctxt param
4381         and pass it to region_model::get_value call.
4382         * diagnostic-manager.cc (get_any_origin): Pass a
4383         tentative_region_model_context to the calls to get_lvalue and reject
4384         the comparison if errors occur.
4385         (can_be_expr_of_interest_p): New function.
4386         (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
4387         CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
4388         Pass a tentative_region_model_context to the calls to
4389         state_change_event::get_lvalue and reject the comparison if errors
4390         occur.
4391         (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
4392         * diagnostic-manager.h
4393         (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
4394         * region-model.h (class tentative_region_model_context): New class.
4395
4396 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
4397
4398         * engine.cc (worklist::worklist): Remove unused field m_eg.
4399         (class viz_callgraph_edge): Remove unused field m_call_sedge.
4400         (class viz_callgraph): Remove unused field m_sg.
4401         * exploded-graph.h (worklist::::m_eg): Remove unused field.
4402
4403 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
4404
4405         * analyzer.opt (fanalyzer-show-duplicate-count): New option.
4406         * diagnostic-manager.cc
4407         (diagnostic_manager::emit_saved_diagnostic): Use the above to
4408         guard the printing of the duplicate count.
4409
4410 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
4411
4412         PR analyzer/93959
4413         * analyzer.cc (is_std_function_p): New function.
4414         (is_std_named_call_p): New functions.
4415         * analyzer.h (is_std_named_call_p): New decl.
4416         * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
4417         variants when checking for malloc, calloc and free.
4418
4419 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
4420
4421         PR analyzer/93950
4422         * diagnostic-manager.cc
4423         (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
4424         either NULL or not a constant.  When updating var, bulletproof
4425         against constant values.
4426
4427 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
4428
4429         PR analyzer/93947
4430         * region-model.cc (region_model::get_fndecl_for_call): Gracefully
4431         fail for fn_decls that don't have a cgraph_node.
4432
4433 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
4434
4435         * bar-chart.cc: New file.
4436         * bar-chart.h: New file.
4437         * engine.cc: Include "analyzer/bar-chart.h".
4438         (stats::log): Only log the m_num_nodes kinds that are non-zero.
4439         (stats::dump): Likewise when dumping.
4440         (stats::get_total_enodes): New.
4441         (exploded_graph::get_or_create_node): Increment the per-point-data
4442         m_excess_enodes when hitting the per-program-point limit on
4443         enodes.
4444         (exploded_graph::print_bar_charts): New.
4445         (exploded_graph::log_stats): Log the number of unprocessed enodes
4446         in the worklist.  Call print_bar_charts.
4447         (exploded_graph::dump_stats): Print the number of unprocessed
4448         enodes in the worklist.
4449         * exploded-graph.h (stats::get_total_enodes): New decl.
4450         (struct per_program_point_data): Add field m_excess_enodes.
4451         (exploded_graph::print_bar_charts): New decl.
4452         * supergraph.cc (superedge::dump): New.
4453         (superedge::dump): New.
4454         * supergraph.h (supernode::get_function): New.
4455         (superedge::dump): New decl.
4456         (superedge::dump): New decl.
4457
4458 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
4459
4460         * engine.cc (exploded_graph::get_or_create_node): Dump the
4461         program_state to the pp, rather than to stderr.
4462
4463 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
4464
4465         PR analyzer/93032
4466         * sm.cc (make_checkers): Require the "taint" checker to be
4467         explicitly enabled.
4468
4469 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
4470
4471         PR analyzer/93899
4472         * engine.cc
4473         (impl_region_model_context::impl_region_model_context): Add logger
4474         param.
4475         * engine.cc (exploded_graph::add_function_entry): Create an
4476         impl_region_model_context and pass it to the push_frame call.
4477         Bail if the resulting state is invalid.
4478         (exploded_graph::build_initial_worklist): Likewise.
4479         (exploded_graph::build_initial_worklist): Handle the case where
4480         add_function_entry fails.
4481         * exploded-graph.h
4482         (impl_region_model_context::impl_region_model_context): Add logger
4483         param.
4484         * region-model.cc (map_region::get_or_create): Add ctxt param and
4485         pass it to add_region_for_type.
4486         (map_region::can_merge_p): Pass NULL as a ctxt to call to
4487         get_or_create.
4488         (array_region::get_element): Pass ctxt to call to get_or_create.
4489         (array_region::get_or_create): Add ctxt param and pass it to
4490         add_region_for_type.
4491         (root_region::push_frame): Pass ctxt to get_or_create calls.
4492         (region_model::get_lvalue_1): Likewise.
4493         (region_model::make_region_for_unexpected_tree_code): Assert that
4494         ctxt is non-NULL.
4495         (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
4496         and get_svalue_for_label calls.
4497         (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
4498         to get_region_for_fndecl.
4499         (region_model::get_region_for_fndecl): Add ctxt param and pass it
4500         to get_or_create.
4501         (region_model::get_svalue_for_label): Add ctxt param and pass it
4502         to get_region_for_label.
4503         (region_model::get_region_for_label): Add ctxt param and pass it
4504         to get_region_for_fndecl and get_or_create.
4505         (region_model::get_field_region): Add ctxt param and pass it to
4506         get_or_create_view and get_or_create.
4507         (make_region_for_type): Replace gcc_unreachable with return NULL.
4508         (region_model::add_region_for_type): Add ctxt param.  Handle a
4509         return of NULL from make_region_for_type by calling
4510         make_region_for_unexpected_tree_code.
4511         (region_model::get_or_create_mem_ref): Pass ctxt to calls to
4512         get_or_create_view.
4513         (region_model::get_or_create_view): Add ctxt param and pass it to
4514         add_region_for_type.
4515         (selftest::test_state_merging): Pass ctxt to get_or_create_view.
4516         * region-model.h (region_model::get_or_create): Add ctxt param.
4517         (region_model::add_region_for_type): Likewise.
4518         (region_model::get_svalue_for_fndecl): Likewise.
4519         (region_model::get_svalue_for_label): Likewise.
4520         (region_model::get_region_for_fndecl): Likewise.
4521         (region_model::get_region_for_label): Likewise.
4522         (region_model::get_field_region): Likewise.
4523         (region_model::get_or_create_view): Likewise.
4524
4525 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
4526
4527         * checker-path.cc (superedge_event::should_filter_p): Update
4528         filter for empty descriptions to cover verbosity level 3 as well
4529         as 2.
4530         * diagnostic-manager.cc: Include "analyzer/reachability.h".
4531         (class path_builder): New class.
4532         (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
4533         and pass it to build_emission_path, rather passing eg; similarly
4534         for add_events_for_eedge and ext_state.
4535         (diagnostic_manager::build_emission_path): Replace "eg" param
4536         with a path_builder, pass it to add_events_for_eedge.
4537         (diagnostic_manager::add_events_for_eedge): Replace ext_state
4538         param with path_builder; pass it to add_events_for_superedge.
4539         (diagnostic_manager::significant_edge_p): New.
4540         (diagnostic_manager::add_events_for_superedge): Add path_builder
4541         param.  Reject insignificant edges at verbosity levels below 3.
4542         (diagnostic_manager::prune_for_sm_diagnostic): Update highest
4543         verbosity level to 4.
4544         * diagnostic-manager.h (class path_builder): New forward decl.
4545         (diagnostic_manager::build_emission_path): Replace "eg" param
4546         with a path_builder.
4547         (diagnostic_manager::add_events_for_eedge): Replace ext_state
4548         param with path_builder.
4549         (diagnostic_manager::significant_edge_p): New.
4550         (diagnostic_manager::add_events_for_superedge): Add path_builder
4551         param.
4552         * reachability.h: New file.
4553
4554 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
4555
4556         PR analyzer/93692
4557         * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
4558
4559 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
4560
4561         PR analyzer/93777
4562         * region-model.cc (region_model::maybe_cast_1): Replace assertion
4563         that build_cast returns non-NULL with a conditional, falling
4564         through to the logic which returns a new unknown value of the
4565         desired type if it fails.
4566
4567 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
4568
4569         PR analyzer/93778
4570         * engine.cc (impl_region_model_context::on_unknown_tree_code):
4571         Rename to...
4572         (impl_region_model_context::on_unexpected_tree_code): ...this and
4573         convert first argument from path_var to tree.
4574         (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
4575         * exploded-graph.h (region_model_context::on_unknown_tree_code):
4576         Rename to...
4577         (region_model_context::on_unexpected_tree_code): ...this and
4578         convert first argument from path_var to tree.
4579         * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
4580         ctxt param and pass on to calls to get_rvalue.
4581         * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
4582         ctxt param.
4583         * region-model.cc (region_model::handle_unrecognized_call): Pass
4584         ctxt on to call to get_rvalue.
4585         (region_model::get_lvalue_1): Move body of default case to
4586         region_model::make_region_for_unexpected_tree_code and call it.
4587         Within COMPONENT_REF case, reject attempts to handle types other
4588         than RECORD_TYPE and UNION_TYPE.
4589         (region_model::make_region_for_unexpected_tree_code): New
4590         function, based on default case of region_model::get_lvalue_1.
4591         * region-model.h
4592         (region_model::make_region_for_unexpected_tree_code): New decl.
4593         (region_model::on_unknown_tree_code): Rename to...
4594         (region_model::on_unexpected_tree_code): ...this and convert first
4595         argument from path_var to tree.
4596         (class test_region_model_context): Update vfunc implementation for
4597         above change.
4598
4599 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
4600
4601         PR analyzer/93774
4602         * region-model.cc
4603         (region_model::convert_byte_offset_to_array_index): Use
4604         int_size_in_bytes before calling size_in_bytes, to gracefully fail
4605         on incomplete types.
4606
4607 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
4608
4609         PR analyzer/93775
4610         * region-model.cc (region_model::get_fndecl_for_call): Handle the
4611         case where the code_region's get_tree_for_child_region returns
4612         NULL.
4613
4614 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
4615
4616         PR analyzer/93388
4617         * engine.cc (impl_region_model_context::on_unknown_tree_code):
4618         New.
4619         (exploded_graph::get_or_create_node): Reject invalid states.
4620         * exploded-graph.h
4621         (impl_region_model_context::on_unknown_tree_code): New decl.
4622         (point_and_state::point_and_state): Assert that the state is
4623         valid.
4624         * program-state.cc (program_state::program_state): Initialize
4625         m_valid to true.
4626         (program_state::operator=): Copy m_valid.
4627         (program_state::program_state): Likewise for move constructor.
4628         (program_state::print): Print m_valid.
4629         (program_state::dump_to_pp): Likewise.
4630         * program-state.h (program_state::m_valid): New field.
4631         * region-model.cc (region_model::get_lvalue_1): Implement the
4632         default case by returning a new symbolic region and calling
4633         the context's on_unknown_tree_code, rather than issuing an
4634         internal_error.  Implement VIEW_CONVERT_EXPR.
4635         * region-model.h (region_model_context::on_unknown_tree_code): New
4636         vfunc.
4637         (test_region_model_context::on_unknown_tree_code): New.
4638
4639 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
4640
4641         * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
4642         transition to the "null" state, only say "assuming" when
4643         transitioning from the "unchecked" state.
4644
4645 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
4646
4647         * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
4648         Add const overload.
4649         * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
4650         * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
4651         const overload.
4652
4653 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4654
4655         PR analyzer/93288
4656         * analysis-plan.cc (analysis_plan::use_summary_p): Look through
4657         the ultimate_alias_target when getting the called function.
4658         * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
4659         "sm_ctxt".  Use the region_model's get_fndecl_for_call rather than
4660         gimple_call_fndecl.
4661         * region-model.cc (region_model::get_fndecl_for_call): Use
4662         ultimate_alias_target on fndecl.
4663         * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
4664         function.
4665         (supergraph_call_edge): Use it when rejecting edges without
4666         functions.
4667         (supergraph::supergraph): Use it to get the function for the
4668         cgraph_edge when building interprocedural superedges.
4669         (callgraph_superedge::get_callee_function):  Use it.
4670         * supergraph.h (supergraph::get_num_snodes): Make param const.
4671         (supergraph::function_to_num_snodes_t): Make first type param
4672         const.
4673
4674 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4675
4676         PR analyzer/93374
4677         * engine.cc (exploded_edge::exploded_edge): Add ext_state param
4678         and pass it to change.validate.
4679         (exploded_graph::get_or_create_node): Move purging of change
4680         svalues to also cover the case of reusing an existing enode.
4681         (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
4682         ctor.
4683         * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
4684         param.
4685         * program-state.cc (state_change::sm_change::validate): Likewise.
4686         Assert that m_sm_idx is sane.  Use ext_state to validate
4687         m_old_state and m_new_state.
4688         (state_change::validate): Add ext_state param and pass it to
4689         the sm_change validate calls.
4690         * program-state.h (state_change::sm_change::validate): Add
4691         ext_state param.
4692         (state_change::validate): Likewise.
4693
4694 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4695
4696         PR analyzer/93669
4697         * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
4698         case of STATUS_WORKLIST in implementation of
4699         "__analyzer_dump_exploded_nodes".
4700
4701 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4702
4703         PR analyzer/93649
4704         * constraint-manager.cc (constraint_manager::add_constraint): When
4705         merging equivalence classes and updating m_constant, also update
4706         m_cst_sid.
4707         (constraint_manager::validate): If m_constant is non-NULL assert
4708         that m_cst_sid is non-null and is valid.
4709
4710 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4711
4712         PR analyzer/93657
4713         * analyzer.opt (fdump-analyzer): Reword description.
4714         (fdump-analyzer-stderr): Likewise.
4715
4716 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
4717
4718         * region-model.cc (print_quoted_type): New function.
4719         (svalue::print): Use it to replace %qT.
4720         (region::dump_to_pp): Likewise.
4721         (region::dump_child_label): Likewise.
4722         (region::print_fields): Likewise.
4723
4724 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
4725
4726         PR analyzer/93659
4727         * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
4728         -> "that" typo.
4729         (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
4730         "uninitialized" typo.
4731
4732 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
4733
4734         PR analyzer/93350
4735         * region-model.cc (region_model::get_lvalue_1):
4736         Handle BIT_FIELD_REF.
4737         (make_region_for_type): Handle VECTOR_TYPE.
4738
4739 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
4740
4741         PR analyzer/93647
4742         * diagnostic-manager.cc
4743         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
4744         VAR being constant.
4745         * region-model.cc (region_model::get_lvalue_1): Provide a better
4746         error message when encountering an unhandled tree code.
4747
4748 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
4749
4750         PR analyzer/93405
4751         * region-model.cc (region_model::get_lvalue_1): Implement
4752         CONST_DECL.
4753
4754 2020-02-06  David Malcolm  <dmalcolm@redhat.com>
4755
4756         * region-model.cc (region_model::maybe_cast_1): Attempt to provide
4757         a region_svalue if either type is a pointer, rather than if both
4758         types are pointers.
4759
4760 2020-02-05  David Malcolm  <dmalcolm@redhat.com>
4761
4762         * engine.cc (exploded_node::dump_dot): Show merger enodes.
4763         (worklist::add_node): Assert that the node's m_status is
4764         STATUS_WORKLIST.
4765         (exploded_graph::process_worklist): Likewise for nodes from the
4766         worklist.  Set status of merged nodes to STATUS_MERGER.
4767         (exploded_graph::process_node): Set status of node to
4768         STATUS_PROCESSED.
4769         (exploded_graph::dump_exploded_nodes): Rework handling of
4770         "__analyzer_dump_exploded_nodes", splitting enodes by status into
4771         "processed" and "merger", showing the count of just the processed
4772         enodes at the call, rather than the count of all enodes.
4773         * exploded-graph.h (exploded_node::status): New enum.
4774         (exploded_node::exploded_node): Initialize m_status to
4775         STATUS_WORKLIST.
4776         (exploded_node::get_status): New getter.
4777         (exploded_node::set_status): New setter.
4778
4779 2020-02-04  David Malcolm  <dmalcolm@redhat.com>
4780
4781         PR analyzer/93543
4782         * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
4783         Eliminate reinterpret_cast.
4784         (pod_hash_traits<function_call_string>::is_empty): Likewise.
4785
4786 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
4787
4788         * constraint-manager.cc (range::constrained_to_single_element):
4789         Replace fold_build2 with fold_binary.  Remove unnecessary newline.
4790         (constraint_manager::get_or_add_equiv_class): Replace fold_build2
4791         with fold_binary in two places, and remove out-of-date comment.
4792         (constraint_manager::eval_condition): Replace fold_build2 with
4793         fold_binary.
4794         * region-model.cc (constant_svalue::eval_condition): Likewise.
4795         (region_model::on_assignment): Likewise.
4796
4797 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
4798
4799         PR analyzer/93544
4800         * diagnostic-manager.cc
4801         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
4802         against bad choices due to bad paths.
4803         * engine.cc (impl_region_model_context::on_phi): New.
4804         * exploded-graph.h (impl_region_model_context::on_phi): New decl.
4805         * region-model.cc (region_model::on_longjmp): Likewise.
4806         (region_model::handle_phi): Add phi param.  Call the ctxt's on_phi
4807         vfunc.
4808         (region_model::update_for_phis): Pass phi to handle_phi.
4809         * region-model.h (region_model::handle_phi): Add phi param.
4810         (region_model_context::on_phi): New vfunc.
4811         (test_region_model_context::on_phi): New.
4812         * sm-malloc.cc (malloc_state_machine::on_phi): New.
4813         (malloc_state_machine::on_zero_assignment): New.
4814         * sm.h (state_machine::on_phi): New vfunc.
4815
4816 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
4817
4818         * engine.cc (supernode_cluster::dump_dot): Show BB index as
4819         well as SN index.
4820         * supergraph.cc (supernode::dump_dot): Likewise.
4821
4822 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
4823
4824         PR analyzer/93546
4825         * region-model.cc (region_model::on_call_pre): Update for new
4826         param of symbolic_region ctor.
4827         (region_model::deref_rvalue): Likewise.
4828         (region_model::add_new_malloc_region): Likewise.
4829         (make_region_for_type): Likewise, preserving type.
4830         * region-model.h (symbolic_region::symbolic_region): Add "type"
4831         param and pass it to base class ctor.
4832
4833 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
4834
4835         PR analyzer/93547
4836         * constraint-manager.cc
4837         (constraint_manager::get_or_add_equiv_class): Ensure types are
4838         compatible before comparing constants.
4839
4840 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4841
4842         PR analyzer/93457
4843         * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
4844         than checking against void_type_node.
4845
4846 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4847
4848         PR analyzer/93373
4849         * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
4850         (assert_compat_types): ...this, and bail when either type is NULL,
4851         or when VOID_TYPE_P (dst_type).
4852         (region_model::get_lvalue): Update for above conversion.
4853         (region_model::get_rvalue): Likewise.
4854
4855 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4856
4857         PR analyzer/93379
4858         * region-model.cc (region_model::update_for_return_superedge):
4859         Move check for null result so that it also guards setting the
4860         lhs.
4861
4862 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4863
4864         PR analyzer/93438
4865         * region-model.cc (stack_region::can_merge_p): Split into a two
4866         pass approach, creating all stack regions first, then populating
4867         them.
4868         (selftest::test_state_merging): Add test coverage for (a) the case
4869         of self-merging a model in which a local in an older stack frame
4870         points to a local in a more recent stack frame (which previously
4871         would ICE), and (b) the case of self-merging a model in which a
4872         local points to a global (which previously worked OK).
4873
4874 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4875
4876         * analyzer.cc (is_named_call_p): Replace tests for fndecl being
4877         extern at file scope and having a non-NULL DECL_NAME with a call
4878         to maybe_special_function_p.
4879         * function-set.cc (function_set::contains_decl_p): Add call to
4880         maybe_special_function_p.
4881
4882 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
4883
4884         PR analyzer/93450
4885         * constraint-manager.cc
4886         (constraint_manager::get_or_add_equiv_class): Only compare constants
4887         if their types are compatible.
4888         * region-model.cc (constant_svalue::eval_condition): Replace check
4889         for identical types with call to types_compatible_p.
4890
4891 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
4892
4893         * program-state.cc (extrinsic_state::dump_to_pp): New.
4894         (extrinsic_state::dump_to_file): New.
4895         (extrinsic_state::dump): New.
4896         * program-state.h (extrinsic_state::dump_to_pp): New decl.
4897         (extrinsic_state::dump_to_file): New decl.
4898         (extrinsic_state::dump): New decl.
4899         * sm.cc: Include "pretty-print.h".
4900         (state_machine::dump_to_pp): New.
4901         * sm.h (state_machine::dump_to_pp): New decl.
4902
4903 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
4904
4905         * diagnostic-manager.cc (for_each_state_change): Use
4906         extrinsic_state::get_num_checkers rather than accessing m_checkers
4907         directly.
4908         * program-state.cc (program_state::program_state): Likewise.
4909         * program-state.h (extrinsic_state::m_checkers): Make private.
4910
4911 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
4912
4913         PR analyzer/93356
4914         * region-model.cc (region_model::eval_condition): In both
4915         overloads, bail out immediately on floating-point types.
4916         (region_model::eval_condition_without_cm): Likewise.
4917         (region_model::add_constraint): Likewise.
4918
4919 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
4920
4921         PR analyzer/93450
4922         * program-state.cc (sm_state_map::set_state): For the overload
4923         taking an svalue_id, bail out if the set_state on the ec does
4924         nothing.  Convert the latter's return type from void to bool,
4925         returning true if anything changed.
4926         (sm_state_map::impl_set_state): Convert the return type from void
4927         to bool, returning true if the state changed.
4928         * program-state.h (sm_state_map::set_state): Convert return type
4929         from void to bool.
4930         (sm_state_map::impl_set_state): Likewise.
4931         * region-model.cc (constant_svalue::eval_condition): Only call
4932         fold_build2 if the types are the same.
4933
4934 2020-01-29  Jakub Jelinek  <jakub@redhat.com>
4935
4936         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
4937         * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
4938         (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
4939         POP_IGNORE_WFORMAT.
4940         * state-purge.cc: Include diagnostic-core.h before
4941         gimple-pretty-print.h.
4942         (state_purge_annotator::add_node_annotations, print_vec_of_names):
4943         Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
4944         * region-model.cc: Move diagnostic-core.h include before graphviz.h.
4945         (path_var::dump, svalue::print, constant_svalue::print_details,
4946         region::dump_to_pp, region::dump_child_label, region::print_fields,
4947         map_region::print_fields, map_region::dump_dot_to_pp,
4948         map_region::dump_child_label, array_region::print_fields,
4949         array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
4950         POP_IGNORE_WFORMAT.
4951
4952 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
4953
4954         PR analyzer/93316
4955         * engine.cc (rewind_info_t::update_model): Get the longjmp call
4956         stmt via get_longjmp_call () rather than assuming it is the last
4957         stmt in the longjmp's supernode.
4958         (rewind_info_t::add_events_to_path): Get the location_t for the
4959         rewind_from_longjmp_event via get_longjmp_call () rather than from
4960         the supernode's get_end_location ().
4961
4962 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
4963
4964         * region-model.cc (poisoned_value_diagnostic::emit): Update for
4965         renaming of warning_at overload to warning_meta.
4966         * sm-file.cc (file_leak::emit): Likewise.
4967         * sm-malloc.cc (double_free::emit): Likewise.
4968         (possible_null_deref::emit): Likewise.
4969         (possible_null_arg::emit): Likewise.
4970         (null_deref::emit): Likewise.
4971         (null_arg::emit): Likewise.
4972         (use_after_free::emit): Likewise.
4973         (malloc_leak::emit): Likewise.
4974         (free_of_non_heap::emit): Likewise.
4975         * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
4976         * sm-signal.cc (signal_unsafe_call::emit): Likewise.
4977         * sm-taint.cc (tainted_array_index::emit): Likewise.
4978
4979 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
4980
4981         PR analyzer/93451
4982         * region-model.cc (tree_cmp): For the REAL_CST case, impose an
4983         arbitrary order on NaNs relative to other NaNs and to non-NaNs;
4984         const-correctness tweak.
4985         (ana::selftests::build_real_cst_from_string): New function.
4986         (ana::selftests::append_interesting_constants): New function.
4987         (ana::selftests::test_tree_cmp_on_constants): New test.
4988         (ana::selftests::test_canonicalization_4): New test.
4989         (ana::selftests::analyzer_region_model_cc_tests): Call the new
4990         tests.
4991
4992 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
4993
4994         PR analyzer/93349
4995         * engine.cc (run_checkers): Save and restore input_location.
4996
4997 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
4998
4999         * call-string.cc (call_string::cmp_1): Delete, moving body to...
5000         (call_string::cmp): ...here.
5001         * call-string.h (call_string::cmp_1): Delete decl.
5002         * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
5003         (worklist::key_t::cmp): ...here.  Implement hash comparisons
5004         via comparison rather than subtraction to avoid overflow issues.
5005         * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
5006         * region-model.cc (tree_cmp): Eliminate buggy checking for
5007         symmetry.
5008
5009 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5010
5011         * analyzer.cc  (is_named_call_p): Check that fndecl is "extern"
5012         and at file scope.  Potentially disregard prefix _ or __ in
5013         fndecl's name.  Bail if the identifier is NULL.
5014         (is_setjmp_call_p): Expect a gcall rather than plain gimple.
5015         Remove special-case check for leading prefix, and also check for
5016         sigsetjmp.
5017         (is_longjmp_call_p): Also check for siglongjmp.
5018         (get_user_facing_name): New function.
5019         * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
5020         gimple.
5021         (get_user_facing_name): New decl.
5022         * checker-path.cc (setjmp_event::get_desc): Use
5023         get_user_facing_name to avoid hardcoding the function name.
5024         (rewind_event::rewind_event): Add rewind_info param, using it to
5025         initialize new m_rewind_info field, and strengthen the assertion.
5026         (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
5027         avoid hardcoding the function name.
5028         (rewind_to_setjmp_event::get_desc): Likewise.
5029         * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
5030         param and use it to initialize...
5031         (setjmp_event::m_setjmp_call): New field.
5032         (rewind_event::rewind_event): Add rewind_info param.
5033         (rewind_event::m_rewind_info): New protected field.
5034         (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
5035         rewind_info param.
5036         (class rewind_to_setjmp_event): Move rewind_info field to parent
5037         class.
5038         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
5039         Update setjmp-handling for is_setjmp_call_p requiring a gcall;
5040         pass the call to the new setjmp_event.
5041         * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
5042         requiring a gcall.
5043         (stale_jmp_buf::emit): Use get_user_facing_name to avoid
5044         hardcoding the function names.
5045         (exploded_node::on_longjmp): Pass the longjmp_call when
5046         constructing rewind_info.
5047         (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
5048         rewind_from_longjmp_event's ctor.
5049         * exploded-graph.h (rewind_info_t::rewind_info_t): Add
5050         longjmp_call param.
5051         (rewind_info_t::get_longjmp_call): New.
5052         (rewind_info_t::m_longjmp_call): New.
5053         * region-model.cc (region_model::on_setjmp): Update comment to
5054         indicate this is also for sigsetjmp.
5055         * region-model.h (struct setjmp_record): Likewise.
5056         (class setjmp_svalue): Likewise.
5057
5058 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
5059
5060         PR analyzer/93276
5061         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
5062         macros with GCC_VERSION >= 4006, making them no-op otherwise.
5063         * engine.cc (exploded_edge::exploded_edge): Specify template for
5064         base class initializer.
5065         (exploded_graph::add_edge): Specify template when chaining up to
5066         base class add_edge implementation.
5067         (viz_callgraph_node::dump_dot): Drop redundant "typename".
5068         (viz_callgraph_edge::viz_callgraph_edge): Specify template for
5069         base class initializer.
5070         * program-state.cc (sm_state_map::clone_with_remapping): Drop
5071         redundant "typename".
5072         (sm_state_map::print): Likewise.
5073         (sm_state_map::hash): Likewise.
5074         (sm_state_map::operator==): Likewise.
5075         (sm_state_map::remap_svalue_ids): Likewise.
5076         (sm_state_map::on_svalue_purge): Likewise.
5077         (sm_state_map::validate): Likewise.
5078         * program-state.h (sm_state_map::iterator_t): Likewise.
5079         * supergraph.h (superedge::superedge): Specify template for base
5080         class initializer.
5081
5082 2020-01-23  David Malcolm  <dmalcolm@redhat.com>
5083
5084         PR analyzer/93375
5085         * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
5086         gracefully is the number of parameters at the callee exceeds the
5087         number of arguments at the call stmt.
5088         (callgraph_superedge::get_parm_for_arg): Likewise.
5089
5090 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5091
5092         PR analyzer/93382
5093         * program-state.cc (sm_state_map::on_svalue_purge): If the
5094         entry survives, but the origin is being purged, then reset the
5095         origin to null.
5096
5097 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5098
5099         * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
5100
5101 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5102
5103         PR analyzer/93378
5104         * engine.cc (setjmp_svalue::compare_fields): Update for
5105         replacement of m_enode with m_setjmp_record.
5106         (setjmp_svalue::add_to_hash): Likewise.
5107         (setjmp_svalue::get_index): Rename...
5108         (setjmp_svalue::get_enode_index): ...to this.
5109         (setjmp_svalue::print_details): Update for replacement of m_enode
5110         with m_setjmp_record.
5111         (exploded_node::on_longjmp): Likewise.
5112         * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
5113         (rewind_info_t::m_setjmp_record): ...with this.
5114         (rewind_info_t::rewind_info_t): Update for replacement of m_enode
5115         with m_setjmp_record.
5116         (rewind_info_t::get_setjmp_point): Likewise.
5117         (rewind_info_t::get_setjmp_call): Likewise.
5118         * region-model.cc (region_model::dump_summary_of_map): Likewise.
5119         (region_model::on_setjmp): Likewise.
5120         * region-model.h (struct setjmp_record): New struct.
5121         (setjmp_svalue::m_enode): Replace...
5122         (setjmp_svalue::m_setjmp_record): ...with this.
5123         (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
5124         with m_setjmp_record.
5125         (setjmp_svalue::clone): Likewise.
5126         (setjmp_svalue::get_index): Rename...
5127         (setjmp_svalue::get_enode_index): ...to this.
5128         (setjmp_svalue::get_exploded_node): Replace...
5129         (setjmp_svalue::get_setjmp_record): ...with this.
5130
5131 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5132
5133         PR analyzer/93316
5134         * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
5135         "_setjmp".
5136
5137 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
5138
5139         PR analyzer/93307
5140         * analysis-plan.h: Wrap everything namespace "ana".
5141         * analyzer-logging.cc: Likewise.
5142         * analyzer-logging.h: Likewise.
5143         * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
5144         namespace.
5145         * analyzer-selftests.cc: Wrap everything namespace "ana".
5146         * analyzer-selftests.h: Likewise.
5147         * analyzer.h: Likewise for forward decls of types.
5148         * call-string.h: Likewise.
5149         * checker-path.cc: Likewise.
5150         * checker-path.h: Likewise.
5151         * constraint-manager.cc: Likewise.
5152         * constraint-manager.h: Likewise.
5153         * diagnostic-manager.cc: Likewise.
5154         * diagnostic-manager.h: Likewise.
5155         * engine.cc: Likewise.
5156         * engine.h: Likewise.
5157         * exploded-graph.h: Likewise.
5158         * function-set.cc: Likewise.
5159         * function-set.h: Likewise.
5160         * pending-diagnostic.cc: Likewise.
5161         * pending-diagnostic.h: Likewise.
5162         * program-point.cc: Likewise.
5163         * program-point.h: Likewise.
5164         * program-state.cc: Likewise.
5165         * program-state.h: Likewise.
5166         * region-model.cc: Likewise.
5167         * region-model.h: Likewise.
5168         * sm-file.cc: Likewise.
5169         * sm-malloc.cc: Likewise.
5170         * sm-pattern-test.cc: Likewise.
5171         * sm-sensitive.cc: Likewise.
5172         * sm-signal.cc: Likewise.
5173         * sm-taint.cc: Likewise.
5174         * sm.cc: Likewise.
5175         * sm.h: Likewise.
5176         * state-purge.h: Likewise.
5177         * supergraph.cc: Likewise.
5178         * supergraph.h: Likewise.
5179
5180 2020-01-21  David Malcolm  <dmalcolm@redhat.com>
5181
5182         PR analyzer/93352
5183         * region-model.cc (int_cmp): Rename to...
5184         (array_region::key_cmp): ...this, using key_t rather than int.
5185         Rewrite in terms of comparisons rather than subtraction to
5186         ensure qsort is anti-symmetric when handling extreme values.
5187         (array_region::walk_for_canonicalization): Update for above
5188         renaming.
5189         * region-model.h (array_region::key_cmp): New decl.
5190
5191 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
5192
5193         PR analyzer/93290
5194         * region-model.cc (region_model::eval_condition_without_cm): Avoid
5195         gcc_unreachable for unexpected operations for the case where
5196         we're comparing an svalue against itself.
5197
5198 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
5199
5200         PR analyzer/93281
5201         * region-model.cc
5202         (region_model::convert_byte_offset_to_array_index): Convert to
5203         ssizetype before dividing by byte_size.  Use fold_binary rather
5204         than fold_build2 to avoid needlessly constructing a tree for the
5205         non-const case.
5206
5207 2020-01-15  David Malcolm  <dmalcolm@redhat.com>
5208
5209         * engine.cc (class impl_region_model_context): Fix comment.
5210
5211 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5212
5213         PR analyzer/93212
5214         * region-model.cc (make_region_for_type): Use
5215         FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
5216         * region-model.h (function_region::function_region): Likewise.
5217
5218 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5219
5220         * program-state.cc (sm_state_map::clone_with_remapping): Copy
5221         m_global_state.
5222         (selftest::test_program_state_merging_2): New selftest.
5223         (selftest::analyzer_program_state_cc_tests): Call it.
5224
5225 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5226
5227         * checker-path.h (checker_path::get_checker_event): New function.
5228         (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
5229         * diagnostic-manager.cc
5230         (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
5231         access to checker_path::m_events with accessor functions.  Fix
5232         overlong line.
5233         (diagnostic_manager::prune_interproc_events): Replace direct
5234         access to checker_path::m_events with accessor functions.
5235         (diagnostic_manager::finish_pruning): Likewise.
5236
5237 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5238
5239         * checker-path.h (checker_event::clone): Delete vfunc decl.
5240         (debug_event::clone): Delete vfunc impl.
5241         (custom_event::clone): Delete vfunc impl.
5242         (statement_event::clone): Delete vfunc impl.
5243         (function_entry_event::clone): Delete vfunc impl.
5244         (state_change_event::clone): Delete vfunc impl.
5245         (start_cfg_edge_event::clone): Delete vfunc impl.
5246         (end_cfg_edge_event::clone): Delete vfunc impl.
5247         (call_event::clone): Delete vfunc impl.
5248         (return_event::clone): Delete vfunc impl.
5249         (setjmp_event::clone): Delete vfunc impl.
5250         (rewind_from_longjmp_event::clone): Delete vfunc impl.
5251         (rewind_to_setjmp_event::clone): Delete vfunc impl.
5252         (warning_event::clone): Delete vfunc impl.
5253
5254 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5255
5256         * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
5257         element has at least one TR.
5258
5259 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5260
5261         PR analyzer/58237
5262         * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
5263         when comparing against UNKNOWN_LOCATION.
5264         (stmt_requires_new_enode_p): Likewise.
5265         (exploded_graph::dump_exploded_nodes): Likewise.
5266         * supergraph.cc (supernode::get_start_location): Likewise.
5267         (supernode::get_end_location): Likewise.
5268
5269 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5270
5271         PR analyzer/58237
5272         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5273         selftest::analyzer_sm_file_cc_tests.
5274         * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
5275         decl.
5276         * sm-file.cc: Include "analyzer/function-set.h" and
5277         "analyzer/analyzer-selftests.h".
5278         (get_file_using_fns): New function.
5279         (is_file_using_fn_p): New function.
5280         (fileptr_state_machine::on_stmt): Return true for known functions.
5281         (selftest::analyzer_sm_file_cc_tests): New function.
5282
5283 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5284
5285         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5286         selftest::analyzer_sm_signal_cc_tests.
5287         * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
5288         New decl.
5289         * sm-signal.cc: Include "analyzer/function-set.h" and
5290         "analyzer/analyzer-selftests.h".
5291         (get_async_signal_unsafe_fns): New function.
5292         (signal_unsafe_p): Reimplement in terms of the above.
5293         (selftest::analyzer_sm_signal_cc_tests): New function.
5294
5295 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5296
5297         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
5298         selftest::analyzer_function_set_cc_tests.
5299         * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
5300         New decl.
5301         * function-set.cc: New file.
5302         * function-set.h: New file.
5303
5304 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5305
5306         * analyzer.h (fndecl_has_gimple_body_p): New decl.
5307         * engine.cc (impl_region_model_context::on_unknown_change): New
5308         function.
5309         (fndecl_has_gimple_body_p): Make non-static.
5310         (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
5311         known.  Track whether we have a call with unknown side-effects and
5312         pass it to on_call_post.
5313         * exploded-graph.h (impl_region_model_context::on_unknown_change):
5314         New decl.
5315         * program-state.cc (sm_state_map::on_unknown_change): New function.
5316         * program-state.h (sm_state_map::on_unknown_change): New decl.
5317         * region-model.cc: Include "bitmap.h".
5318         (region_model::on_call_pre): Return a bool, capturing whether the
5319         call has unknown side effects.
5320         (region_model::on_call_post): Add arg "bool unknown_side_effects"
5321         and if true, call handle_unrecognized_call.
5322         (class reachable_regions): New class.
5323         (region_model::handle_unrecognized_call): New function.
5324         * region-model.h (region_model::on_call_pre): Return a bool.
5325         (region_model::on_call_post): Add arg "bool unknown_side_effects".
5326         (region_model::handle_unrecognized_call): New decl.
5327         (region_model_context::on_unknown_change): New vfunc.
5328         (test_region_model_context::on_unknown_change): New function.
5329
5330 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5331
5332         * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
5333         from header.  Replace pointer equality test on m_var with call to
5334         pending_diagnostic::same_tree_p.
5335         * diagnostic-manager.h (saved_diagnostic::operator==): Move to
5336         diagnostic-manager.cc.
5337         * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
5338         * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
5339         * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
5340         equality on m_arg with call to pending_diagnostic::same_tree_p.
5341         * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
5342         (possible_null_arg::subclass_equal_p): Likewise.
5343         (null_arg::subclass_equal_p): Likewise.
5344         (free_of_non_heap::subclass_equal_p): Likewise.
5345         * sm-pattern-test.cc (pattern_match::operator==): Likewise.
5346         * sm-sensitive.cc (exposure_through_output_file::operator==):
5347         Likewise.
5348         * sm-taint.cc (tainted_array_index::operator==): Likewise.
5349
5350 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5351
5352         * diagnostic-manager.cc (dedupe_winners::add): Add logging
5353         of deduplication decisions made.
5354
5355 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
5356
5357         * ChangeLog: New file.
5358         * analyzer-selftests.cc: New file.
5359         * analyzer-selftests.h: New file.
5360         * analyzer.opt: New file.
5361         * analysis-plan.cc: New file.
5362         * analysis-plan.h: New file.
5363         * analyzer-logging.cc: New file.
5364         * analyzer-logging.h: New file.
5365         * analyzer-pass.cc: New file.
5366         * analyzer.cc: New file.
5367         * analyzer.h: New file.
5368         * call-string.cc: New file.
5369         * call-string.h: New file.
5370         * checker-path.cc: New file.
5371         * checker-path.h: New file.
5372         * constraint-manager.cc: New file.
5373         * constraint-manager.h: New file.
5374         * diagnostic-manager.cc: New file.
5375         * diagnostic-manager.h: New file.
5376         * engine.cc: New file.
5377         * engine.h: New file.
5378         * exploded-graph.h: New file.
5379         * pending-diagnostic.cc: New file.
5380         * pending-diagnostic.h: New file.
5381         * program-point.cc: New file.
5382         * program-point.h: New file.
5383         * program-state.cc: New file.
5384         * program-state.h: New file.
5385         * region-model.cc: New file.
5386         * region-model.h: New file.
5387         * sm-file.cc: New file.
5388         * sm-malloc.cc: New file.
5389         * sm-malloc.dot: New file.
5390         * sm-pattern-test.cc: New file.
5391         * sm-sensitive.cc: New file.
5392         * sm-signal.cc: New file.
5393         * sm-taint.cc: New file.
5394         * sm.cc: New file.
5395         * sm.h: New file.
5396         * state-purge.cc: New file.
5397         * state-purge.h: New file.
5398         * supergraph.cc: New file.
5399         * supergraph.h: New file.
5400
5401 2019-12-13  David Malcolm  <dmalcolm@redhat.com>
5402
5403         * Initial creation
5404
5405 \f
5406 Copyright (C) 2019-2021 Free Software Foundation, Inc.
5407
5408 Copying and distribution of this file, with or without modification,
5409 are permitted in any medium without royalty provided the copyright
5410 notice and this notice are preserved.