From e9aae62e8bca3abfc1dc36f67845444291171e13 Mon Sep 17 00:00:00 2001 From: Ted Kremenek Date: Fri, 17 May 2013 09:41:40 +0000 Subject: [PATCH] [analyzer; alternate edges] improve support for edges with PseudoObjectExprs. This optimizes some spurious edges resulting from PseudoObjectExprs. This required far more changes than I anticipated. The current ParentMap does not record any hierarchy information between a PseudoObjectExpr and its *semantic* expressions that may be wrapped in OpaqueValueExprs, which are the expressions actually laid out in the CFG. This means the arrow pruning logic could not map from an expression to its containing PseudoObjectExprs. To solve this, this patch adds a variant of ParentMap that returns the "semantic" parentage of expressions (essentially as they are viewed by the CFG). This alternate ParentMap is then used by the arrow reducing logic to identify edges into pseudo object expressions, and then eliminate them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@182083 91177308-0d34-0410-b5e6-96231b3b80d8 --- include/clang/AST/ParentMap.h | 3 +- include/clang/Analysis/AnalysisContext.h | 8 ++ lib/AST/ParentMap.cpp | 30 +++--- lib/Analysis/AnalysisDeclContext.cpp | 30 ++++-- lib/StaticAnalyzer/Core/BugReporter.cpp | 111 ++++++++++++++++++++++- 5 files changed, 156 insertions(+), 26 deletions(-) diff --git a/include/clang/AST/ParentMap.h b/include/clang/AST/ParentMap.h index 62eae02c15..9ec7753012 100644 --- a/include/clang/AST/ParentMap.h +++ b/include/clang/AST/ParentMap.h @@ -20,8 +20,9 @@ class Expr; class ParentMap { void* Impl; + bool IsSemantic; public: - ParentMap(Stmt* ASTRoot); + ParentMap(Stmt* ASTRoot, bool isSemantic = false); ~ParentMap(); /// \brief Adds and/or updates the parent/child-relations of the complete diff --git a/include/clang/Analysis/AnalysisContext.h b/include/clang/Analysis/AnalysisContext.h index 46d7d07e09..1e6d70591c 100644 --- a/include/clang/Analysis/AnalysisContext.h +++ b/include/clang/Analysis/AnalysisContext.h @@ -82,6 +82,7 @@ class AnalysisDeclContext { bool builtCFG, builtCompleteCFG; OwningPtr PM; + OwningPtr SemanticPM; OwningPtr PCA; OwningPtr CFA; @@ -165,6 +166,9 @@ public: bool isCFGBuilt() const { return builtCFG; } ParentMap &getParentMap(); + + ParentMap &getSemanticParentMap(); + PseudoConstantAnalysis *getPseudoConstantAnalysis(); typedef const VarDecl * const * referenced_decls_iterator; @@ -245,6 +249,10 @@ public: return getAnalysisDeclContext()->getParentMap(); } + ParentMap &getSemanticParentMap() const { + return getAnalysisDeclContext()->getSemanticParentMap(); + } + const ImplicitParamDecl *getSelfDecl() const { return Ctx->getSelfDecl(); } diff --git a/lib/AST/ParentMap.cpp b/lib/AST/ParentMap.cpp index 113592860b..735926d81d 100644 --- a/lib/AST/ParentMap.cpp +++ b/lib/AST/ParentMap.cpp @@ -25,7 +25,7 @@ enum OpaqueValueMode { OV_Opaque }; -static void BuildParentMap(MapTy& M, Stmt* S, +static void BuildParentMap(MapTy& M, Stmt* S, bool isSemantic, OpaqueValueMode OVMode = OV_Transparent) { switch (S->getStmtClass()) { @@ -33,14 +33,17 @@ static void BuildParentMap(MapTy& M, Stmt* S, assert(OVMode == OV_Transparent && "Should not appear alongside OVEs"); PseudoObjectExpr *POE = cast(S); - M[POE->getSyntacticForm()] = S; - BuildParentMap(M, POE->getSyntacticForm(), OV_Transparent); + if (!isSemantic) { + M[POE->getSyntacticForm()] = S; + BuildParentMap(M, POE->getSyntacticForm(), OV_Transparent); + } for (PseudoObjectExpr::semantics_iterator I = POE->semantics_begin(), E = POE->semantics_end(); I != E; ++I) { M[*I] = S; - BuildParentMap(M, *I, OV_Opaque); + BuildParentMap(M, *I, isSemantic, + isSemantic ? OV_Transparent : OV_Opaque); } break; } @@ -49,16 +52,16 @@ static void BuildParentMap(MapTy& M, Stmt* S, BinaryConditionalOperator *BCO = cast(S); M[BCO->getCommon()] = S; - BuildParentMap(M, BCO->getCommon(), OV_Transparent); + BuildParentMap(M, BCO->getCommon(), isSemantic, OV_Transparent); M[BCO->getCond()] = S; - BuildParentMap(M, BCO->getCond(), OV_Opaque); + BuildParentMap(M, BCO->getCond(), isSemantic, OV_Opaque); M[BCO->getTrueExpr()] = S; - BuildParentMap(M, BCO->getTrueExpr(), OV_Opaque); + BuildParentMap(M, BCO->getTrueExpr(), isSemantic, OV_Opaque); M[BCO->getFalseExpr()] = S; - BuildParentMap(M, BCO->getFalseExpr(), OV_Transparent); + BuildParentMap(M, BCO->getFalseExpr(), isSemantic, OV_Transparent); break; } @@ -66,24 +69,25 @@ static void BuildParentMap(MapTy& M, Stmt* S, if (OVMode == OV_Transparent) { OpaqueValueExpr *OVE = cast(S); M[OVE->getSourceExpr()] = S; - BuildParentMap(M, OVE->getSourceExpr(), OV_Transparent); + BuildParentMap(M, OVE->getSourceExpr(), isSemantic, OV_Transparent); } break; default: for (Stmt::child_range I = S->children(); I; ++I) { if (*I) { M[*I] = S; - BuildParentMap(M, *I, OVMode); + BuildParentMap(M, *I, isSemantic, OVMode); } } break; } } -ParentMap::ParentMap(Stmt* S) : Impl(0) { +ParentMap::ParentMap(Stmt* S, bool isSemantic) : Impl(0), + IsSemantic(isSemantic) { if (S) { MapTy *M = new MapTy(); - BuildParentMap(*M, S); + BuildParentMap(*M, S, isSemantic); Impl = M; } } @@ -94,7 +98,7 @@ ParentMap::~ParentMap() { void ParentMap::addStmt(Stmt* S) { if (S) { - BuildParentMap(*(MapTy*) Impl, S); + BuildParentMap(*(MapTy*) Impl, S, IsSemantic); } } diff --git a/lib/Analysis/AnalysisDeclContext.cpp b/lib/Analysis/AnalysisDeclContext.cpp index 5ff7842407..316892ea91 100644 --- a/lib/Analysis/AnalysisDeclContext.cpp +++ b/lib/Analysis/AnalysisDeclContext.cpp @@ -212,20 +212,34 @@ void AnalysisDeclContext::dumpCFG(bool ShowColors) { getCFG()->dump(getASTContext().getLangOpts(), ShowColors); } +static ParentMap *constructParentMap(bool isSemantic, + Stmt *Body, + const Decl *D) { + ParentMap *PM = new ParentMap(Body, isSemantic); + if (const CXXConstructorDecl *C = dyn_cast(D)) { + for (CXXConstructorDecl::init_const_iterator I = C->init_begin(), + E = C->init_end(); + I != E; ++I) { + PM->addStmt((*I)->getInit()); + } + } + return PM; +} + ParentMap &AnalysisDeclContext::getParentMap() { if (!PM) { - PM.reset(new ParentMap(getBody())); - if (const CXXConstructorDecl *C = dyn_cast(getDecl())) { - for (CXXConstructorDecl::init_const_iterator I = C->init_begin(), - E = C->init_end(); - I != E; ++I) { - PM->addStmt((*I)->getInit()); - } - } + PM.reset(constructParentMap(false, getBody(), getDecl())); } return *PM; } +ParentMap &AnalysisDeclContext::getSemanticParentMap() { + if (!SemanticPM) { + SemanticPM.reset(constructParentMap(true, getBody(), getDecl())); + } + return *SemanticPM; +} + PseudoConstantAnalysis *AnalysisDeclContext::getPseudoConstantAnalysis() { if (!PCA) PCA.reset(new PseudoConstantAnalysis(getBody())); diff --git a/lib/StaticAnalyzer/Core/BugReporter.cpp b/lib/StaticAnalyzer/Core/BugReporter.cpp index 519555396d..ab3464507d 100644 --- a/lib/StaticAnalyzer/Core/BugReporter.cpp +++ b/lib/StaticAnalyzer/Core/BugReporter.cpp @@ -1873,9 +1873,78 @@ static bool isIncrementOrInitInForLoop(const Stmt *S, const Stmt *FL) { typedef llvm::DenseSet OptimizedCallsSet; +typedef llvm::DenseMap > + PseudoObjectExprMap; + +/// Return the PseudoObjectExpr that contains this statement (if any). +static const PseudoObjectExpr * +getContainingPseudoObjectExpr(PseudoObjectExprMap &PEM, + ParentMap &PM, + const Stmt *S) { + if (!S) + return 0; + + Optional &Entry = PEM[S]; + if (!Entry.hasValue()) { + const Stmt *Parent = PM.getParentIgnoreParens(S); + if (const PseudoObjectExpr *PE = dyn_cast_or_null(Parent)) + Entry = PE; + else + Entry = getContainingPseudoObjectExpr(PEM, PM, Parent); + } + return Entry.getValue(); +} + +#if 0 +static void printPath(PathPieces &path, ParentMap &PM) { + unsigned index = 0; + for (PathPieces::iterator I = path.begin(), E = path.end(); I != E; ++I ) { + llvm::errs() << "[" << index++ << "]\n"; + if (isa(*I)) { + llvm::errs() << " CALL\n"; + continue; + } + if (isa(*I)) { + llvm::errs() << " EVENT\n"; + continue; + } + if (const PathDiagnosticControlFlowPiece *CP = dyn_cast(*I)) { + llvm::errs() << " CONTROL\n"; + const Stmt *s1Start = getLocStmt(CP->getStartLocation()); + const Stmt *s1End = getLocStmt(CP->getEndLocation()); + if (s1Start) { + s1Start->dump(); + llvm::errs() << "PARENT: \n"; + const Stmt *Parent = getStmtParent(s1Start, PM); + if (Parent) { + Parent->dump(); + } + } + else { + llvm::errs() << "NULL\n"; + } + llvm::errs() << " --------- ===== ----- \n"; + if (s1End) { + s1End->dump(); + llvm::errs() << "PARENT: \n"; + const Stmt *Parent = getStmtParent(s1End, PM); + if (Parent) { + Parent->dump(); + } + } + else { + llvm::errs() << "NULL\n"; + } + } + } +} +#endif + static bool optimizeEdges(PathPieces &path, SourceManager &SM, OptimizedCallsSet &OCS, - LocationContextMap &LCM) { + LocationContextMap &LCM, + PseudoObjectExprMap &PEM) { bool hasChanges = false; const LocationContext *LC = LCM[&path]; assert(LC); @@ -1890,7 +1959,7 @@ static bool optimizeEdges(PathPieces &path, SourceManager &SM, // Record the fact that a call has been optimized so we only do the // effort once. if (!OCS.count(CallI)) { - while (optimizeEdges(CallI->path, SM, OCS, LCM)) {} + while (optimizeEdges(CallI->path, SM, OCS, LCM, PEM)) {} OCS.insert(CallI); } ++I; @@ -1906,7 +1975,7 @@ static bool optimizeEdges(PathPieces &path, SourceManager &SM, continue; } - ParentMap &PM = LC->getParentMap(); + ParentMap &PM = LC->getSemanticParentMap(); const Stmt *s1Start = getLocStmt(PieceI->getStartLocation()); const Stmt *s1End = getLocStmt(PieceI->getEndLocation()); const Stmt *level1 = getStmtParent(s1Start, PM); @@ -1933,6 +2002,39 @@ static bool optimizeEdges(PathPieces &path, SourceManager &SM, } } + // Prune out edges for pseudo object expressions. + // + // Case 1: incoming into a pseudo expr. + // + // An edge into a subexpression of a pseudo object expression + // should be replaced with an edge to the pseudo object expression + // itself. + const PseudoObjectExpr *PE = getContainingPseudoObjectExpr(PEM, PM, s1End); + if (PE) { + PathDiagnosticLocation L(PE, SM, LC); + PieceI->setEndLocation(L); + // Do not increment the iterator. It is possible we will match again. + hasChanges = true; + continue; + } + + // Prune out edges for pseudo object expressions. + // + // Case 2: outgoing from a pseudo expr. + // + // An edge into a subexpression of a pseudo object expression + // should be replaced with an edge to the pseudo object expression + // itself. + PE = getContainingPseudoObjectExpr(PEM, PM, s1Start); + if (PE) { + PathDiagnosticLocation L(PE, SM, LC); + PieceI->setStartLocation(L); + // Do not increment the iterator. It is possible we will match again. + hasChanges = true; + continue; + } + + // Pattern match on two edges after this point. PathPieces::iterator NextI = I; ++NextI; if (NextI == E) break; @@ -2782,7 +2884,8 @@ bool GRBugReporter::generatePathDiagnostic(PathDiagnostic& PD, // to an aesthetically pleasing subset that conveys the // necessary information. OptimizedCallsSet OCS; - while (optimizeEdges(PD.getMutablePieces(), SM, OCS, LCM)) {} + PseudoObjectExprMap PEM; + while (optimizeEdges(PD.getMutablePieces(), SM, OCS, LCM, PEM)) {} // Adjust edges into loop conditions to make them more uniform // and aesthetically pleasing. -- 2.40.0