Here's an updated version of the patch kit, addressing many issues from review, and squashing in other changes.
This is v4, and is relative to r279310 (2019-12-12) Earlier versions: v3: https://gcc.gnu.org/ml/gcc-patches/2019-12/msg00529.html v2: https://gcc.gnu.org/ml/gcc-patches/2019-11/msg02024.html v1: https://gcc.gnu.org/ml/gcc-patches/2019-11/msg01543.html See also: https://gcc.gnu.org/wiki/DavidMalcolm/StaticAnalyzer High-level changes (relative to v1): - dropped the in-tree plugin idea; the analyzer is now part of the compiler - added a configure-time way to disable the build of the compiler. It is built by default (but off by default at compile-time); all of the analyzer-specific code is guarded by #if ENABLE_ANALYZER - moved some files from "gcc/analyzer" to "gcc" (digraph.cc.h, graphviz.cc/h, shortest-paths.h, and tristate.cc/h). I've kept the "gcc/analyzer" subdirectory. I assume that it's sane to have a gcc/analyzer subdirectory, and that it ought to have its own ChangeLog file (it doesn't yet). - renamed the option from --analyzer to -fanalyzer; -fno-analyzer is now supported (and the last one wins) - fixed the LTO crasher, so basic cross-TU analysis via "-flto -fanalyzer" works - added a new sm-signal.cc for detecting fprintf calls in signal handlers, along with various cleanups and generalizations this needed (which will be helpful long-term for e.g. C++ exception support) - I've already committed some of v1's approved preliminary patches to trunk Other changes: - the various fixups needed due to rebasing (changes to param-handling, json API) - rewrote .dot output to avoid shape=record, as it's poorly supported in more recent versions of GraphViz - fixed missing leak diagnostic on longjmp past a free, and show the rewind destination for this case - fixed issues in diagnostic_manager::prune_path - added an sm-malloc.dot to visualize the state machine - added more internal validation - better support for resolving function pointers - added DISABLE_COPY_AND_ASSIGN in various places - split diagnostic_manager::prune_path into subroutines as per review - special-case strcmp calls when describing edge events (I found this helpful for debugging the reproducer for detecting CVE-2005-1689) - added a test for .dot output to the testsuite, with directives such as: /* { dg-require-dot "" } */ and /* { dg-final { dg-check-dot "dot-output.c.callgraph.dot" } } */ - dropped all those //// comment lines Not yet changed: - this currently needs the fix to hash_table::empty_slow from: https://gcc.gnu.org/ml/gcc-patches/2019-12/msg00776.html which I still need to gather info about - I've experimented with eliminating make_label_text, and have something that works, but the patch currently has a lot warnings, so am deferring for now - struct vs class in exploded-graph.h - probably other things Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to the git mirror as branch "dmalcolm/analyzer-v4": https://gcc.gnu.org/git/?p=gcc.git;a=shortlog;h=refs/heads/dmalcolm/analyzer-v4 Dave David Malcolm (45): gimple const-correctness fixes hash-map-tests.c: add a selftest involving int_hash analyzer: user-facing documentation analyzer: internal documentation Add pp_write_text_as_html_like_dot_to_stream sbitmap.h: add operator const sbitmap & to auto_sbitmap vec.h: add auto_delete_vec Add -fdiagnostics-nn-line-numbers Add diagnostic_metadata and CWE support Add diagnostic paths Add ordered_hash_map timevar.def: add TVs for analyzer analyzer: changes to configure.ac analyzer: add new files to Makefile.in analyzer: new files: analyzer-selftests.{cc|h} analyzer: new builtins analyzer: command-line options analyzer: logging support analyzer: new file: analyzer-pass.cc and pass registration analyzer: new files: graphviz.{cc|h} analyzer: new files: digraph.{cc|h} and shortest-paths.h analyzer: new files: supergraph.{cc|h} analyzer: new files: analyzer.{cc|h} analyzer: new files: tristate.{cc|h} analyzer: new files: constraint-manager.{cc|h} analyzer: new files: region-model.{cc|h} analyzer: new files: pending-diagnostic.{cc|h} analyzer: new files: sm.{cc|h} analyzer: new files: sm-malloc.cc and sm-malloc.dot analyzer: new file: sm-file.cc analyzer: new file: sm-pattern-test.cc analyzer: new file: sm-sensitive.cc analyzer: new file: sm-signal.cc analyzer: new file: sm-taint.cc analyzer: new files: analysis-plan.{cc|h} analyzer: new files: call-string.{cc|h} analyzer: new files: program-point.{cc|h} analyzer: new files: program-state.{cc|h} analyzer: new file: exploded-graph.h analyzer: new files: state-purge.{cc|h} analyzer: new files: engine.{cc|h} analyzer: new files: checker-path.{cc|h} analyzer: new files: diagnostic-manager.{cc|h} gdbinit.in: add break-on-saved-diagnostic analyzer: test suite gcc/Makefile.in | 36 +- gcc/analyzer/analysis-plan.cc | 118 + gcc/analyzer/analysis-plan.h | 58 + gcc/analyzer/analyzer-logging.cc | 224 + gcc/analyzer/analyzer-logging.h | 262 + gcc/analyzer/analyzer-pass.cc | 102 + gcc/analyzer/analyzer-selftests.cc | 60 + gcc/analyzer/analyzer-selftests.h | 44 + gcc/analyzer/analyzer.cc | 150 + gcc/analyzer/analyzer.h | 124 + gcc/analyzer/analyzer.opt | 181 + gcc/analyzer/call-string.cc | 224 + gcc/analyzer/call-string.h | 76 + gcc/analyzer/checker-path.cc | 931 ++ gcc/analyzer/checker-path.h | 589 ++ gcc/analyzer/constraint-manager.cc | 2251 +++++ gcc/analyzer/constraint-manager.h | 248 + gcc/analyzer/diagnostic-manager.cc | 1217 +++ gcc/analyzer/diagnostic-manager.h | 137 + gcc/analyzer/engine.cc | 3583 ++++++++ gcc/analyzer/engine.h | 26 + gcc/analyzer/exploded-graph.h | 830 ++ gcc/analyzer/pending-diagnostic.cc | 64 + gcc/analyzer/pending-diagnostic.h | 269 + gcc/analyzer/program-point.cc | 529 ++ gcc/analyzer/program-point.h | 313 + gcc/analyzer/program-state.cc | 1331 +++ gcc/analyzer/program-state.h | 365 + gcc/analyzer/region-model.cc | 7773 +++++++++++++++++ gcc/analyzer/region-model.h | 2065 +++++ gcc/analyzer/sm-file.cc | 334 + gcc/analyzer/sm-malloc.cc | 794 ++ gcc/analyzer/sm-malloc.dot | 89 + gcc/analyzer/sm-pattern-test.cc | 149 + gcc/analyzer/sm-sensitive.cc | 245 + gcc/analyzer/sm-signal.cc | 306 + gcc/analyzer/sm-taint.cc | 325 + gcc/analyzer/sm.cc | 136 + gcc/analyzer/sm.h | 182 + gcc/analyzer/state-purge.cc | 525 ++ gcc/analyzer/state-purge.h | 164 + gcc/analyzer/supergraph.cc | 955 ++ gcc/analyzer/supergraph.h | 564 ++ gcc/builtins.def | 33 + gcc/c-family/c-format.c | 7 + gcc/c-family/c-format.h | 1 + gcc/common.opt | 32 + gcc/configure.ac | 14 +- gcc/coretypes.h | 1 + gcc/diagnostic-color.c | 3 +- gcc/diagnostic-core.h | 10 + gcc/diagnostic-event-id.h | 61 + gcc/diagnostic-format-json.cc | 34 +- gcc/diagnostic-metadata.h | 42 + gcc/diagnostic-path.h | 149 + gcc/diagnostic-show-locus.c | 79 +- gcc/diagnostic.c | 281 +- gcc/diagnostic.def | 5 + gcc/diagnostic.h | 43 +- gcc/digraph.cc | 188 + gcc/digraph.h | 246 + gcc/doc/analyzer.texi | 496 ++ gcc/doc/gccint.texi | 2 + gcc/doc/invoke.texi | 615 +- gcc/dwarf2out.c | 1 + gcc/gcc-rich-location.h | 4 +- gcc/gdbinit.in | 10 + gcc/gimple-predict.h | 4 +- gcc/gimple-pretty-print.c | 159 +- gcc/gimple-pretty-print.h | 3 +- gcc/gimple.h | 156 +- gcc/graphviz.cc | 100 + gcc/graphviz.h | 53 + gcc/hash-map-tests.c | 41 + gcc/lto-wrapper.c | 3 + gcc/opts.c | 16 + gcc/ordered-hash-map-tests.cc | 247 + gcc/ordered-hash-map.h | 184 + gcc/passes.def | 1 + gcc/pretty-print.c | 80 + gcc/pretty-print.h | 3 + gcc/sbitmap.h | 1 + gcc/selftest-run-tests.c | 8 + gcc/selftest.h | 4 + gcc/shortest-paths.h | 145 + .../gcc.dg/analyzer/CVE-2005-1689-minimal.c | 30 + gcc/testsuite/gcc.dg/analyzer/abort.c | 71 + gcc/testsuite/gcc.dg/analyzer/alloca-leak.c | 8 + .../gcc.dg/analyzer/analyzer-verbosity-0.c | 162 + .../gcc.dg/analyzer/analyzer-verbosity-1.c | 190 + .../gcc.dg/analyzer/analyzer-verbosity-2.c | 221 + gcc/testsuite/gcc.dg/analyzer/analyzer.exp | 49 + .../gcc.dg/analyzer/attribute-nonnull.c | 81 + .../gcc.dg/analyzer/call-summaries-1.c | 14 + .../gcc.dg/analyzer/conditionals-2.c | 44 + .../gcc.dg/analyzer/conditionals-3.c | 45 + .../gcc.dg/analyzer/conditionals-notrans.c | 158 + .../gcc.dg/analyzer/conditionals-trans.c | 143 + gcc/testsuite/gcc.dg/analyzer/data-model-1.c | 1084 +++ gcc/testsuite/gcc.dg/analyzer/data-model-10.c | 17 + gcc/testsuite/gcc.dg/analyzer/data-model-11.c | 6 + gcc/testsuite/gcc.dg/analyzer/data-model-12.c | 13 + gcc/testsuite/gcc.dg/analyzer/data-model-13.c | 21 + gcc/testsuite/gcc.dg/analyzer/data-model-14.c | 24 + gcc/testsuite/gcc.dg/analyzer/data-model-15.c | 34 + gcc/testsuite/gcc.dg/analyzer/data-model-16.c | 50 + gcc/testsuite/gcc.dg/analyzer/data-model-17.c | 20 + gcc/testsuite/gcc.dg/analyzer/data-model-18.c | 20 + gcc/testsuite/gcc.dg/analyzer/data-model-19.c | 31 + gcc/testsuite/gcc.dg/analyzer/data-model-2.c | 13 + gcc/testsuite/gcc.dg/analyzer/data-model-3.c | 15 + gcc/testsuite/gcc.dg/analyzer/data-model-4.c | 16 + gcc/testsuite/gcc.dg/analyzer/data-model-5.c | 100 + gcc/testsuite/gcc.dg/analyzer/data-model-5b.c | 91 + gcc/testsuite/gcc.dg/analyzer/data-model-5c.c | 84 + gcc/testsuite/gcc.dg/analyzer/data-model-5d.c | 63 + gcc/testsuite/gcc.dg/analyzer/data-model-6.c | 13 + gcc/testsuite/gcc.dg/analyzer/data-model-7.c | 19 + gcc/testsuite/gcc.dg/analyzer/data-model-8.c | 24 + gcc/testsuite/gcc.dg/analyzer/data-model-9.c | 32 + .../gcc.dg/analyzer/data-model-path-1.c | 13 + gcc/testsuite/gcc.dg/analyzer/disabling.c | 10 + gcc/testsuite/gcc.dg/analyzer/dot-output.c | 33 + .../gcc.dg/analyzer/double-free-lto-1-a.c | 16 + .../gcc.dg/analyzer/double-free-lto-1-b.c | 8 + .../gcc.dg/analyzer/double-free-lto-1.h | 1 + gcc/testsuite/gcc.dg/analyzer/equivalence.c | 29 + gcc/testsuite/gcc.dg/analyzer/explode-1.c | 60 + gcc/testsuite/gcc.dg/analyzer/explode-2.c | 50 + gcc/testsuite/gcc.dg/analyzer/factorial.c | 7 + gcc/testsuite/gcc.dg/analyzer/fibonacci.c | 9 + gcc/testsuite/gcc.dg/analyzer/fields.c | 41 + gcc/testsuite/gcc.dg/analyzer/file-1.c | 37 + gcc/testsuite/gcc.dg/analyzer/file-2.c | 18 + .../gcc.dg/analyzer/function-ptr-1.c | 8 + .../gcc.dg/analyzer/function-ptr-2.c | 43 + .../gcc.dg/analyzer/function-ptr-3.c | 17 + gcc/testsuite/gcc.dg/analyzer/gzio-2.c | 11 + gcc/testsuite/gcc.dg/analyzer/gzio-3.c | 31 + gcc/testsuite/gcc.dg/analyzer/gzio-3a.c | 27 + gcc/testsuite/gcc.dg/analyzer/gzio.c | 17 + .../gcc.dg/analyzer/infinite-recursion.c | 55 + gcc/testsuite/gcc.dg/analyzer/loop-2.c | 36 + gcc/testsuite/gcc.dg/analyzer/loop-2a.c | 39 + gcc/testsuite/gcc.dg/analyzer/loop-3.c | 17 + gcc/testsuite/gcc.dg/analyzer/loop-4.c | 41 + gcc/testsuite/gcc.dg/analyzer/loop.c | 33 + gcc/testsuite/gcc.dg/analyzer/malloc-1.c | 585 ++ gcc/testsuite/gcc.dg/analyzer/malloc-2.c | 23 + gcc/testsuite/gcc.dg/analyzer/malloc-3.c | 8 + .../gcc.dg/analyzer/malloc-callbacks.c | 84 + gcc/testsuite/gcc.dg/analyzer/malloc-dce.c | 12 + .../gcc.dg/analyzer/malloc-dedupe-1.c | 46 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c | 24 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c | 32 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-11.c | 95 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c | 7 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13.c | 30 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c | 34 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c | 23 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c | 13 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c | 13 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-6.c | 22 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-7.c | 29 + .../analyzer/malloc-ipa-8-double-free.c | 172 + .../gcc.dg/analyzer/malloc-ipa-8-lto-a.c | 12 + .../gcc.dg/analyzer/malloc-ipa-8-lto-b.c | 18 + .../gcc.dg/analyzer/malloc-ipa-8-lto-c.c | 17 + .../gcc.dg/analyzer/malloc-ipa-8-lto.h | 12 + .../gcc.dg/analyzer/malloc-ipa-8-unchecked.c | 66 + gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c | 18 + .../analyzer/malloc-macro-inline-events.c | 45 + .../analyzer/malloc-macro-separate-events.c | 15 + gcc/testsuite/gcc.dg/analyzer/malloc-macro.h | 2 + .../gcc.dg/analyzer/malloc-many-paths-1.c | 14 + .../gcc.dg/analyzer/malloc-many-paths-2.c | 30 + .../gcc.dg/analyzer/malloc-many-paths-3.c | 36 + .../gcc.dg/analyzer/malloc-paths-1.c | 15 + .../gcc.dg/analyzer/malloc-paths-10.c | 19 + .../gcc.dg/analyzer/malloc-paths-2.c | 13 + .../gcc.dg/analyzer/malloc-paths-3.c | 14 + .../gcc.dg/analyzer/malloc-paths-4.c | 20 + .../gcc.dg/analyzer/malloc-paths-5.c | 43 + .../gcc.dg/analyzer/malloc-paths-6.c | 11 + .../gcc.dg/analyzer/malloc-paths-7.c | 21 + .../gcc.dg/analyzer/malloc-paths-8.c | 54 + .../gcc.dg/analyzer/malloc-paths-9.c | 298 + .../gcc.dg/analyzer/malloc-vs-local-1a.c | 180 + .../gcc.dg/analyzer/malloc-vs-local-1b.c | 175 + .../gcc.dg/analyzer/malloc-vs-local-2.c | 178 + .../gcc.dg/analyzer/malloc-vs-local-3.c | 65 + .../gcc.dg/analyzer/malloc-vs-local-4.c | 40 + gcc/testsuite/gcc.dg/analyzer/operations.c | 42 + gcc/testsuite/gcc.dg/analyzer/params-2.c | 16 + gcc/testsuite/gcc.dg/analyzer/params.c | 32 + gcc/testsuite/gcc.dg/analyzer/paths-1.c | 16 + gcc/testsuite/gcc.dg/analyzer/paths-1a.c | 16 + gcc/testsuite/gcc.dg/analyzer/paths-2.c | 25 + gcc/testsuite/gcc.dg/analyzer/paths-3.c | 48 + gcc/testsuite/gcc.dg/analyzer/paths-4.c | 49 + gcc/testsuite/gcc.dg/analyzer/paths-5.c | 10 + gcc/testsuite/gcc.dg/analyzer/paths-6.c | 118 + gcc/testsuite/gcc.dg/analyzer/paths-7.c | 58 + .../gcc.dg/analyzer/pattern-test-1.c | 28 + .../gcc.dg/analyzer/pattern-test-2.c | 29 + .../gcc.dg/analyzer/pointer-merging.c | 16 + gcc/testsuite/gcc.dg/analyzer/pr61861.c | 2 + gcc/testsuite/gcc.dg/analyzer/pragma-1.c | 26 + gcc/testsuite/gcc.dg/analyzer/scope-1.c | 23 + gcc/testsuite/gcc.dg/analyzer/sensitive-1.c | 55 + gcc/testsuite/gcc.dg/analyzer/setjmp-1.c | 1 + gcc/testsuite/gcc.dg/analyzer/setjmp-2.c | 97 + gcc/testsuite/gcc.dg/analyzer/setjmp-3.c | 106 + gcc/testsuite/gcc.dg/analyzer/setjmp-4.c | 107 + gcc/testsuite/gcc.dg/analyzer/setjmp-5.c | 65 + gcc/testsuite/gcc.dg/analyzer/setjmp-6.c | 31 + gcc/testsuite/gcc.dg/analyzer/setjmp-7.c | 36 + gcc/testsuite/gcc.dg/analyzer/setjmp-7a.c | 110 + gcc/testsuite/gcc.dg/analyzer/setjmp-8.c | 107 + gcc/testsuite/gcc.dg/analyzer/setjmp-9.c | 109 + gcc/testsuite/gcc.dg/analyzer/signal-1.c | 31 + gcc/testsuite/gcc.dg/analyzer/signal-2.c | 34 + gcc/testsuite/gcc.dg/analyzer/signal-3.c | 23 + gcc/testsuite/gcc.dg/analyzer/signal-4a.c | 74 + gcc/testsuite/gcc.dg/analyzer/signal-4b.c | 89 + gcc/testsuite/gcc.dg/analyzer/strcmp-1.c | 35 + gcc/testsuite/gcc.dg/analyzer/switch.c | 28 + gcc/testsuite/gcc.dg/analyzer/taint-1.c | 128 + gcc/testsuite/gcc.dg/analyzer/zlib-1.c | 67 + gcc/testsuite/gcc.dg/analyzer/zlib-2.c | 51 + gcc/testsuite/gcc.dg/analyzer/zlib-3.c | 214 + gcc/testsuite/gcc.dg/analyzer/zlib-4.c | 20 + gcc/testsuite/gcc.dg/analyzer/zlib-5.c | 49 + gcc/testsuite/gcc.dg/analyzer/zlib-6.c | 47 + gcc/testsuite/gcc.dg/format/gcc_diag-10.c | 6 +- .../plugin/diagnostic-path-format-default.c | 142 + .../diagnostic-path-format-inline-events-1.c | 142 + .../diagnostic-path-format-inline-events-2.c | 154 + .../diagnostic-path-format-inline-events-3.c | 153 + .../plugin/diagnostic-path-format-none.c | 43 + .../diagnostic-path-format-separate-events.c | 44 + .../gcc.dg/plugin/diagnostic-test-paths-1.c | 38 + .../gcc.dg/plugin/diagnostic-test-paths-2.c | 56 + .../gcc.dg/plugin/diagnostic-test-paths-3.c | 38 + .../gcc.dg/plugin/diagnostic-test-paths-4.c | 83 + .../plugin/diagnostic_plugin_test_paths.c | 460 + gcc/testsuite/gcc.dg/plugin/plugin.exp | 11 + gcc/testsuite/lib/gcc-defs.exp | 21 + gcc/testsuite/lib/target-supports-dg.exp | 10 + gcc/testsuite/lib/target-supports.exp | 21 + gcc/timevar.def | 11 + gcc/toplev.c | 8 + gcc/tree-diagnostic-path.cc | 820 ++ gcc/tree-diagnostic.c | 12 +- gcc/tree-diagnostic.h | 8 + gcc/tree-eh.c | 6 +- gcc/tree-eh.h | 4 +- gcc/tree-pass.h | 1 + gcc/tree-ssa-alias.h | 2 +- gcc/tree-ssa-structalias.c | 2 +- gcc/tristate.cc | 221 + gcc/tristate.h | 82 + gcc/vec.c | 27 + gcc/vec.h | 38 + libcpp/include/line-map.h | 7 + libcpp/line-map.c | 3 +- 266 files changed, 43658 insertions(+), 193 deletions(-) create mode 100644 gcc/analyzer/analysis-plan.cc create mode 100644 gcc/analyzer/analysis-plan.h create mode 100644 gcc/analyzer/analyzer-logging.cc create mode 100644 gcc/analyzer/analyzer-logging.h create mode 100644 gcc/analyzer/analyzer-pass.cc create mode 100644 gcc/analyzer/analyzer-selftests.cc create mode 100644 gcc/analyzer/analyzer-selftests.h create mode 100644 gcc/analyzer/analyzer.cc create mode 100644 gcc/analyzer/analyzer.h create mode 100644 gcc/analyzer/analyzer.opt create mode 100644 gcc/analyzer/call-string.cc create mode 100644 gcc/analyzer/call-string.h create mode 100644 gcc/analyzer/checker-path.cc create mode 100644 gcc/analyzer/checker-path.h create mode 100644 gcc/analyzer/constraint-manager.cc create mode 100644 gcc/analyzer/constraint-manager.h create mode 100644 gcc/analyzer/diagnostic-manager.cc create mode 100644 gcc/analyzer/diagnostic-manager.h create mode 100644 gcc/analyzer/engine.cc create mode 100644 gcc/analyzer/engine.h create mode 100644 gcc/analyzer/exploded-graph.h create mode 100644 gcc/analyzer/pending-diagnostic.cc create mode 100644 gcc/analyzer/pending-diagnostic.h create mode 100644 gcc/analyzer/program-point.cc create mode 100644 gcc/analyzer/program-point.h create mode 100644 gcc/analyzer/program-state.cc create mode 100644 gcc/analyzer/program-state.h create mode 100644 gcc/analyzer/region-model.cc create mode 100644 gcc/analyzer/region-model.h create mode 100644 gcc/analyzer/sm-file.cc create mode 100644 gcc/analyzer/sm-malloc.cc create mode 100644 gcc/analyzer/sm-malloc.dot create mode 100644 gcc/analyzer/sm-pattern-test.cc create mode 100644 gcc/analyzer/sm-sensitive.cc create mode 100644 gcc/analyzer/sm-signal.cc create mode 100644 gcc/analyzer/sm-taint.cc create mode 100644 gcc/analyzer/sm.cc create mode 100644 gcc/analyzer/sm.h create mode 100644 gcc/analyzer/state-purge.cc create mode 100644 gcc/analyzer/state-purge.h create mode 100644 gcc/analyzer/supergraph.cc create mode 100644 gcc/analyzer/supergraph.h create mode 100644 gcc/diagnostic-event-id.h create mode 100644 gcc/diagnostic-metadata.h create mode 100644 gcc/diagnostic-path.h create mode 100644 gcc/digraph.cc create mode 100644 gcc/digraph.h create mode 100644 gcc/doc/analyzer.texi create mode 100644 gcc/graphviz.cc create mode 100644 gcc/graphviz.h create mode 100644 gcc/ordered-hash-map-tests.cc create mode 100644 gcc/ordered-hash-map.h create mode 100644 gcc/shortest-paths.h create mode 100644 gcc/testsuite/gcc.dg/analyzer/CVE-2005-1689-minimal.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/abort.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/alloca-leak.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-0.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer.exp create mode 100644 gcc/testsuite/gcc.dg/analyzer/attribute-nonnull.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-notrans.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-trans.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-10.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-11.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-12.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-13.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-14.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-15.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-16.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-17.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-18.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-19.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5b.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5c.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5d.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-6.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-7.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-8.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-9.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/disabling.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/dot-output.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1-a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1-b.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1.h create mode 100644 gcc/testsuite/gcc.dg/analyzer/equivalence.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/explode-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/explode-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/factorial.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/fibonacci.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/fields.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/file-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/file-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-3a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/infinite-recursion.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-2a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-callbacks.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-dce.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-dedupe-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-11.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-6.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-7.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-b.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-c.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto.h create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro-inline-events.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro-separate-events.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro.h create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-10.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/operations.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/params-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/params.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-6.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-7.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/pattern-test-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/pointer-merging.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr61861.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/pragma-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/scope-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/sensitive-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-6.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-7.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-7a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-8.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-9.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-4a.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-4b.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/strcmp-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/switch.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-1.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-2.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-3.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-4.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-5.c create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-6.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-default.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-1.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-2.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-3.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-none.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-separate-events.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-1.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-2.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-3.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-4.c create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic_plugin_test_paths.c create mode 100644 gcc/tree-diagnostic-path.cc create mode 100644 gcc/tristate.cc create mode 100644 gcc/tristate.h -- 2.21.0