Skip to content
  • Ted Kremenek's avatar
    This is a fairly large patch, which resulted from a cascade of changes · 1f22aa74
    Ted Kremenek authored
    made to RegionStore (and related classes) in order to handle some
    analyzer failures involving casts and manipulation of symbolic memory.
    
    The root of the change is in StoreManager::CastRegion().  Instead of
    using ad hoc heuristics to decide when to layer an ElementRegion on a
    casted MemRegion, we now always layer an ElementRegion when the cast
    type is different than the original type of the region.  This carries
    the current cast information associated with a region around without
    resorting to the error prone recording of "casted types" in GRState.
    
    Along with this new policy of layering ElementRegions, I added a new
    algorithm to strip away existing ElementRegions when they simply
    represented casts of a base memory object.  This algorithm computes
    the raw "byte offset" that an ElementRegion represents from the base
    region, and allows the new ElementRegion to be based off that offset.
    The added benefit is that this naturally handles a series of casts of
    a MemRegion without building up a set of redundant ElementRegions
    (thus canonicalizing the region view).
    
    Other related changes that cascaded from this one (as tests were
    failing in RegionStore):
    
    - Revamped RegionStoreManager::InvalidateRegion() to completely remove
      all bindings and default values from a region and all subregions.
      Now invalidated fields are not bound directly to new symbolic
      values; instead the base region has a "default" symbol value from
      which "derived symbols" can be created.  The main advantage of this
      approach is that it allows us to invalidate a region hierarchy and
      then lazily instantiate new values no matter how deep the hierarchy
      went (i.e., regardless of the number of field accesses,
      e.g. x->f->y->z->...).  The previous approach did not do this.
    
    - Slightly reworked RegionStoreManager::RemoveDeadBindings() to also
      incorporate live symbols and live regions that do not have direct
      bindings but also have "default values" used for lazy instantiation.
      The changes to 'InvalidateRegion' revealed that these were necessary
      in order to achieve lazy instantiation of values in the region store
      with those bindings being removed too early.
    
    - The changes to InvalidateRegion() and RemoveDeadBindings() revealed
      a serious bug in 'getSubRegionMap()' where not all region -> subregion
      relationships involved in actually bindings (explicit and implicit)
      were being recorded.  This has been fixed by using a worklist algorithm
      to iteratively fill in the region map.
    
    - Added special support to RegionStoreManager::Bind()/Retrieve() to handle
      OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the
      layering of ElementRegions.
    
    - Fixed a bug in SymbolReaper::isLive() where derived symbols were not
      being marked live if the symbol they were derived from was also live.
      This fix was critical for getting lazy instantiation in RegionStore
      to work.
    
    - Tidied up the implementation of ValueManager::getXXXSymbolVal() methods
      to use SymbolManager::canSymbolicate() to decide whether or not a
      symbol should be symbolicated.
    
    - 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been
      moved to 'test/Analysis/misc-ps.m'.
    
    - Tweaked some pretty-printing of MemRegions, and implemented
      'ElementRegion::getRawOffset()' for use with the CastRegion changes.
    
    llvm-svn: 77782
    1f22aa74
Loading