I've just pushed this patch kit to trunk for GCC 17, as
r17-6239-g104f7f7d145d1d through r17-6246-g7647c00b77ee1a.
See the last patch (8/8) for a high-level description of the changes,
along with slides 42 onwards of my 2026 Cauldron talk.
Successfully regrtested on x86_64-pc-linux-gnu.
Successfully bootstrapped & regrtested on aarch64-unknown-linux-gnu.
Successful run of analyzer integration tests on
aarch64-unknown-linux-gnu.
I verified that the selftests pass on aarch64 with both -mbig-endian and
-mlittle-endian, and on arm-unknown-eabi and pdp11-dec-aout (to get
32-bit target coverage).
Lightly tested with valgrind.
This should be a significant improvement in the maintainability and
accuracy of the analyzer, but given the size of the patches:
191 files changed, 33916 insertions(+), 12328 deletions(-)
it's inevitable that I've broken *something*; sorry in advance.
Dave
David Malcolm (8):
diagnostics: add diagnostics::markup
analyzer: add integer class
analyzer: add unit-safe integer classes
analyzer: add concrete-ranges.h/cc
analyzer: rename symbol to symbolic::node
analyzer: add selftests and more member fns for struct complexity
analyzer: add node_manager
analyzer: rewrite of symbolic value handling
gcc/Makefile.in | 15 +-
gcc/analyzer/access-diagram.cc | 1218 ++---
gcc/analyzer/access-diagram.h | 89 +-
gcc/analyzer/ana-state-to-diagnostic-state.cc | 94 +-
gcc/analyzer/ana-state-to-diagnostic-state.h | 5 +-
gcc/analyzer/analyzer-logging.cc | 5 +
gcc/analyzer/analyzer-logging.h | 7 +
gcc/analyzer/analyzer-selftests.cc | 68 +-
gcc/analyzer/analyzer-selftests.h | 32 +-
gcc/analyzer/bounds-checking.cc | 972 ++--
gcc/analyzer/call-details.cc | 101 +-
gcc/analyzer/call-details.h | 14 +-
gcc/analyzer/call-string.cc | 29 +
gcc/analyzer/call-string.h | 9 +
gcc/analyzer/call-summary.cc | 676 ++-
gcc/analyzer/call-summary.h | 39 +-
gcc/analyzer/checker-event.cc | 3 +-
gcc/analyzer/common.h | 232 +-
gcc/analyzer/complexity.cc | 63 +-
gcc/analyzer/complexity.h | 31 +-
gcc/analyzer/concrete-ranges.cc | 770 +++
gcc/analyzer/concrete-ranges.h | 142 +
gcc/analyzer/constraint-manager.cc | 366 +-
gcc/analyzer/constraint-manager.h | 5 +-
gcc/analyzer/diagnostic-manager.cc | 60 +-
gcc/analyzer/engine.cc | 202 +-
gcc/analyzer/exploded-graph.h | 27 +-
gcc/analyzer/exploded-path.cc | 6 +-
gcc/analyzer/feasible-graph.cc | 4 +-
gcc/analyzer/infinite-recursion.cc | 116 +-
gcc/analyzer/initializers.cc | 287 ++
gcc/analyzer/integer-with-unit.cc | 580 +++
gcc/analyzer/integer-with-unit.h | 403 ++
gcc/analyzer/integer.cc | 493 ++
gcc/analyzer/integer.h | 297 ++
gcc/analyzer/kf-analyzer.cc | 49 +-
gcc/analyzer/kf-lang-cp.cc | 31 +-
gcc/analyzer/kf.cc | 182 +-
gcc/analyzer/liveness-context.h | 70 +
gcc/analyzer/ops.cc | 16 +-
gcc/analyzer/poisoned-value-diagnostic.cc | 35 +-
gcc/analyzer/program-point.cc | 34 +-
gcc/analyzer/program-point.h | 4 +
gcc/analyzer/program-state.cc | 785 ++--
gcc/analyzer/program-state.h | 40 +-
gcc/analyzer/ranges.cc | 328 --
gcc/analyzer/ranges.h | 100 -
gcc/analyzer/record-layout.cc | 30 +-
gcc/analyzer/record-layout.h | 25 +-
gcc/analyzer/region-model-asm.cc | 9 +-
gcc/analyzer/region-model-manager.cc | 1120 ++---
gcc/analyzer/region-model-manager.h | 96 +-
gcc/analyzer/region-model-reachability.cc | 195 +-
gcc/analyzer/region-model-reachability.h | 16 +-
gcc/analyzer/region-model.cc | 3560 +++++++-------
gcc/analyzer/region-model.h | 280 +-
gcc/analyzer/region.cc | 2013 ++++----
gcc/analyzer/region.h | 517 +-
gcc/analyzer/setjmp-longjmp.cc | 26 +-
gcc/analyzer/sm-fd.cc | 7 +-
gcc/analyzer/sm-file.cc | 18 +-
gcc/analyzer/sm-malloc.cc | 18 +-
gcc/analyzer/sm-signal.cc | 2 +-
gcc/analyzer/sm-taint.cc | 92 +-
gcc/analyzer/state-purge.cc | 19 +-
gcc/analyzer/store.cc | 3588 ++++----------
gcc/analyzer/store.h | 1068 ++---
gcc/analyzer/string-scan.cc | 751 +++
gcc/analyzer/string-scan.h | 143 +
gcc/analyzer/svalue.cc | 1838 +++-----
gcc/analyzer/svalue.h | 872 ++--
gcc/analyzer/symbol.h | 53 -
gcc/analyzer/symbolic-bit-contents.cc | 4186 +++++++++++++++++
gcc/analyzer/symbolic-bit-contents.h | 1165 +++++
gcc/analyzer/symbolic-bit-vectors.cc | 4074 ++++++++++++++++
gcc/analyzer/symbolic-bit-vectors.h | 1396 ++++++
gcc/analyzer/symbolic-memory-offsets.h | 96 +
gcc/analyzer/symbolic-memory-ranges.cc | 137 +
gcc/analyzer/symbolic-memory-ranges.h | 85 +
gcc/analyzer/symbolic-nodes.cc | 557 +++
gcc/analyzer/symbolic-nodes.h | 706 +++
gcc/analyzer/symbolic-pointers.cc | 324 ++
gcc/analyzer/symbolic-pointers.h | 100 +
gcc/analyzer/symbolic-ranges.cc | 373 ++
gcc/analyzer/symbolic-ranges.h | 190 +
gcc/analyzer/symbolic-scalars.cc | 2847 +++++++++++
gcc/analyzer/symbolic-scalars.h | 905 ++++
gcc/analyzer/{symbol.cc => type.h} | 34 +-
gcc/analyzer/units.h | 69 +
gcc/analyzer/varargs.cc | 242 +-
gcc/analyzer/write-to-const-diagnostics.cc | 28 +-
gcc/custom-sarif-properties/state-graphs.cc | 2 +-
gcc/custom-sarif-properties/state-graphs.h | 2 +-
gcc/diagnostics/color.cc | 9 +-
gcc/diagnostics/diagnostics-selftests.cc | 1 +
gcc/diagnostics/diagnostics-selftests.h | 1 +
gcc/diagnostics/markup.cc | 734 +++
gcc/diagnostics/markup.h | 596 +++
gcc/doc/analyzer.texi | 248 +-
gcc/selftest-run-tests.cc | 1 +
.../c-c++-common/analyzer/aliasing-6.c | 80 +
.../c-c++-common/analyzer/attr-const-3.c | 2 +-
.../analyzer/call-summaries-malloc.c | 10 +-
.../analyzer/call-summaries-pr107158-2.c | 4 +-
.../analyzer/call-summaries-pr107158.c | 4 +-
.../c-c++-common/analyzer/capacity-1.c | 2 +-
.../analyzer/compound-assignment-5.c | 2 +-
.../analyzer/deref-before-check-3.c | 56 +
.../c-c++-common/analyzer/double-free-2.c | 8 +
.../analyzer/flex-with-call-summaries.c | 3 +-
.../analyzer/flex-without-call-summaries.c | 6 +-
...nfinite-loop-doom-d_main-IdentifyVersion.c | 2 +-
.../c-c++-common/analyzer/large-constants.c | 37 +
.../analyzer/leak-multiple-returns.c | 20 +
.../leak-pr108045-with-call-summaries.c | 4 +-
.../c-c++-common/analyzer/leak-pr126831.c | 29 +
.../c-c++-common/analyzer/leak-pr126832.c | 34 +
.../loop-0-up-to-n-by-1-with-iter-obj.c | 1 +
gcc/testsuite/c-c++-common/analyzer/loop-2.c | 5 +-
gcc/testsuite/c-c++-common/analyzer/loop-2a.c | 5 +-
.../c-c++-common/analyzer/maybe-live-1.c | 47 +
.../c-c++-common/analyzer/maybe-live-2.c | 11 +
.../c-c++-common/analyzer/null-compare.c | 25 +
.../analyzer/null-terminated-strings-2.c | 6 +-
.../analyzer/out-of-bounds-bits.c | 66 +
.../analyzer/out-of-bounds-diagram-11.c | 72 +-
.../analyzer/out-of-bounds-diagram-3.c | 3 +-
.../analyzer/out-of-bounds-diagram-pr110928.c | 10 +-
.../analyzer/out-of-bounds-pr114472.c | 10 +
gcc/testsuite/c-c++-common/analyzer/paths-5.c | 2 +-
.../analyzer/pointer-comparison-pr125304-eq.c | 16 +-
.../analyzer/pointer-comparison-pr125304-ge.c | 9 +-
.../analyzer/pointer-comparison-pr125304-gt.c | 5 +-
.../analyzer/pointer-comparison-pr125304-le.c | 9 +-
.../analyzer/pointer-comparison-pr125304-lt.c | 5 +-
.../c-c++-common/analyzer/strlen-pr113999.c | 6 +-
.../c-c++-common/analyzer/strncpy-1.c | 12 +-
.../c-c++-common/analyzer/symbolic-1.c | 3 +-
.../c-c++-common/analyzer/symbolic-4.c | 2 +-
.../c-c++-common/analyzer/taint-inheritance.c | 68 +
.../analyzer/uintptr-cast-double-free.c | 65 +
.../c-c++-common/analyzer/use-after-free-4.c | 85 +
.../c-c++-common/analyzer/use-after-free-5.c | 64 +
...er-show-events-in-system-headers-default.C | 2 +-
...nalyzer-show-events-in-system-headers-no.C | 2 +-
.../analyzer/initializers-with-RANGE_EXPR.C | 20 +
.../analyzer/out-of-bounds-placement-new.C | 1 +
gcc/testsuite/g++.dg/analyzer/pr100244.C | 1 +
.../g++.dg/analyzer/std-unique_ptr-3.C | 17 +
.../torture/std-string-ctor-large-literal.C | 3 +-
.../torture/std-string-ctor-small-literal.C | 3 +-
.../gcc.dg/analyzer/analyzer-decls.h | 6 +
.../gcc.dg/analyzer/boxed-malloc-1.c | 6 +-
.../gcc.dg/analyzer/call-summaries-2.c | 33 +-
gcc/testsuite/gcc.dg/analyzer/data-model-1.c | 3 +-
.../analyzer/doom-d_main-IdentifyVersion.c | 46 +-
gcc/testsuite/gcc.dg/analyzer/ice-pr113496.c | 2 +-
.../gcc.dg/analyzer/leak-expressions-1.c | 185 +
.../gcc.dg/analyzer/leak-pr126832-macro.c | 63 +
gcc/testsuite/gcc.dg/analyzer/mkdtemp-1.c | 16 +-
.../gcc.dg/analyzer/null-deref-pr102671-1.c | 2 +-
.../analyzer/null-terminated-strings-1.c | 30 +-
.../analyzer/out-of-bounds-diagram-1-debug.c | 42 +-
.../analyzer/out-of-bounds-diagram-16.c | 2 +-
.../gcc.dg/analyzer/out-of-bounds-diagram-2.c | 28 +-
.../gcc.dg/analyzer/out-of-bounds-diagram-9.c | 33 +-
.../gcc.dg/analyzer/pattern-test-2.c | 2 +-
gcc/testsuite/gcc.dg/analyzer/pipe-1.c | 2 -
gcc/testsuite/gcc.dg/analyzer/pipe2-1.c | 2 -
gcc/testsuite/gcc.dg/analyzer/pr104417.c | 3 +-
.../gcc.dg/analyzer/pr104434-nonconst.c | 4 +-
.../gcc.dg/analyzer/pr93355-localealias.c | 2 +-
gcc/testsuite/gcc.dg/analyzer/pr93382.c | 2 +-
gcc/testsuite/gcc.dg/analyzer/single-field.c | 2 +-
.../gcc.dg/analyzer/state-diagram-2.c | 2 +-
.../gcc.dg/analyzer/state-diagram-5-sarif.py | 4 +-
.../gcc.dg/analyzer/stdarg-1-ms_abi.c | 6 +-
gcc/testsuite/gcc.dg/analyzer/stdarg-1.c | 6 +-
gcc/testsuite/gcc.dg/analyzer/stdarg-2.c | 6 +-
gcc/testsuite/gcc.dg/analyzer/strcpy-3.c | 1 -
gcc/testsuite/gcc.dg/analyzer/strlen-1.c | 35 +
.../gcc.dg/analyzer/taint-read-offset-1.c | 6 +-
.../gcc.dg/analyzer/torture/loop-inc-ptr-2.c | 2 +-
.../gcc.dg/analyzer/torture/pr59037.c | 4 +
gcc/testsuite/gcc.dg/analyzer/unknown-fns-5.c | 52 +
gcc/testsuite/gcc.dg/analyzer/unknown-fns-6.c | 20 +
gcc/testsuite/gcc.dg/analyzer/vla-1.c | 9 +-
.../gcc.dg/plugin/infoleak-CVE-2011-1078-1.c | 4 +
.../gcc.dg/plugin/infoleak-uninit-size-1.c | 2 +-
.../gcc.dg/plugin/infoleak-vfio_iommu_type1.c | 3 +-
.../plugin/taint-pr112850-too-complex.c | 4 +-
191 files changed, 33916 insertions(+), 12328 deletions(-)
create mode 100644 gcc/analyzer/concrete-ranges.cc
create mode 100644 gcc/analyzer/concrete-ranges.h
create mode 100644 gcc/analyzer/initializers.cc
create mode 100644 gcc/analyzer/integer-with-unit.cc
create mode 100644 gcc/analyzer/integer-with-unit.h
create mode 100644 gcc/analyzer/integer.cc
create mode 100644 gcc/analyzer/integer.h
create mode 100644 gcc/analyzer/liveness-context.h
delete mode 100644 gcc/analyzer/ranges.cc
delete mode 100644 gcc/analyzer/ranges.h
create mode 100644 gcc/analyzer/string-scan.cc
create mode 100644 gcc/analyzer/string-scan.h
delete mode 100644 gcc/analyzer/symbol.h
create mode 100644 gcc/analyzer/symbolic-bit-contents.cc
create mode 100644 gcc/analyzer/symbolic-bit-contents.h
create mode 100644 gcc/analyzer/symbolic-bit-vectors.cc
create mode 100644 gcc/analyzer/symbolic-bit-vectors.h
create mode 100644 gcc/analyzer/symbolic-memory-offsets.h
create mode 100644 gcc/analyzer/symbolic-memory-ranges.cc
create mode 100644 gcc/analyzer/symbolic-memory-ranges.h
create mode 100644 gcc/analyzer/symbolic-nodes.cc
create mode 100644 gcc/analyzer/symbolic-nodes.h
create mode 100644 gcc/analyzer/symbolic-pointers.cc
create mode 100644 gcc/analyzer/symbolic-pointers.h
create mode 100644 gcc/analyzer/symbolic-ranges.cc
create mode 100644 gcc/analyzer/symbolic-ranges.h
create mode 100644 gcc/analyzer/symbolic-scalars.cc
create mode 100644 gcc/analyzer/symbolic-scalars.h
rename gcc/analyzer/{symbol.cc => type.h} (60%)
create mode 100644 gcc/analyzer/units.h
create mode 100644 gcc/diagnostics/markup.cc
create mode 100644 gcc/diagnostics/markup.h
create mode 100644 gcc/testsuite/c-c++-common/analyzer/aliasing-6.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/deref-before-check-3.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/double-free-2.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/large-constants.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/leak-multiple-returns.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/leak-pr126831.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/leak-pr126832.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/maybe-live-1.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/maybe-live-2.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/null-compare.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/out-of-bounds-bits.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/taint-inheritance.c
create mode 100644
gcc/testsuite/c-c++-common/analyzer/uintptr-cast-double-free.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/use-after-free-4.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/use-after-free-5.c
create mode 100644 gcc/testsuite/g++.dg/analyzer/initializers-with-RANGE_EXPR.C
create mode 100644 gcc/testsuite/g++.dg/analyzer/std-unique_ptr-3.C
create mode 100644 gcc/testsuite/gcc.dg/analyzer/leak-expressions-1.c
create mode 100644 gcc/testsuite/gcc.dg/analyzer/leak-pr126832-macro.c
create mode 100644 gcc/testsuite/gcc.dg/analyzer/unknown-fns-5.c
create mode 100644 gcc/testsuite/gcc.dg/analyzer/unknown-fns-6.c
--
2.56.0
