pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2c35ba51ea'
${ noResults }
infer_clone/infer/tests/codetoanalyze/cpp/pulse/issues.exp

32 lines
4.8 KiB
Raw Normal View History Unescape

[pulse] Invalidate addresses for destructors Summary: Invalidating addresses for destructors to catch use after destructor errors. To pass ownership tests for use after destructor errors, we still need to: (1) fix pointer arithmetic false positives (2) add model for placement new to fix false positives (3) add model for operator= to fix false positives (4) support inter-procedural analysis for destructor_order_bad test Reviewed By: jvillard Differential Revision: D10450912 fbshipit-source-id: 2d9b1ee68
6 years ago
codetoanalyze/cpp/ownership/basics.cpp, aggregate_reassign2_ok, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(a)` here,accessed `&(a.str)` here]
codetoanalyze/cpp/ownership/basics.cpp, aggregate_reassign3_ok, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(a)` here,accessed `&(a.a.str)` here]
codetoanalyze/cpp/ownership/basics.cpp, aggregate_reassign_ok, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(s)` here,accessed `s.i` here]
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_branch_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `ptr` here,accessed `*(ptr)` here]
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_loop_bad, 8, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `ptr` here,accessed `*(ptr)` here]
[pulse] Invalidate addresses for destructors Summary: Invalidating addresses for destructors to catch use after destructor errors. To pass ownership tests for use after destructor errors, we still need to: (1) fix pointer arithmetic false positives (2) add model for placement new to fix false positives (3) add model for operator= to fix false positives (4) support inter-procedural analysis for destructor_order_bad test Reviewed By: jvillard Differential Revision: D10450912 fbshipit-source-id: 2d9b1ee68
6 years ago
codetoanalyze/cpp/ownership/basics.cpp, pointer_arithmetic_ok, 2, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `a` here,accessed `a` here]
codetoanalyze/cpp/ownership/basics.cpp, struct_inside_loop_ok, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(a)` here,accessed `&(a)` here]
codetoanalyze/cpp/ownership/returns.cpp, returns::FN_return_destructed_pointer_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
[pulse] rename `Location` -> `Address` and better reporting Summary: `Location` was clashing with the `Location` module, so use `Address` instead. When invalidating an address, remember the "actor" of its invalidation, i.e. the access expression leading to the address and the source location of the corresponding instruction. When checking accesses, also pass the actor responsible for the access, so that when we raise an error we know: 1. when and why a location was invalidated 2. when and why we tried to read it after that Reviewed By: mbouaziz Differential Revision: D10446282 fbshipit-source-id: 3ca4fb3d4
6 years ago
codetoanalyze/cpp/ownership/returns.cpp, returns::return_deleted_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `x` here,accessed `x` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, delete_in_branch_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, delete_in_loop_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
codetoanalyze/cpp/ownership/use_after_delete.cpp, delete_ref_in_loop_ok, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `v.__internal_array[_]` here]
[pulse] rename `Location` -> `Address` and better reporting Summary: `Location` was clashing with the `Location` module, so use `Address` instead. When invalidating an address, remember the "actor" of its invalidation, i.e. the access expression leading to the address and the source location of the corresponding instruction. When checking accesses, also pass the actor responsible for the access, so that when we raise an error we know: 1. when and why a location was invalidated 2. when and why we tried to read it after that Reviewed By: mbouaziz Differential Revision: D10446282 fbshipit-source-id: 3ca4fb3d4
6 years ago
codetoanalyze/cpp/ownership/use_after_delete.cpp, deref_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, double_delete_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, gated_delete_abort_ok, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, gated_delete_throw_ok, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, gated_exit_abort_ok, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, reassign_field_of_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s->f` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, return_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, use_in_branch_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_delete.cpp, use_in_loop_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `s->f` here]
[pulse] Model placement new Summary: Modeling `placement new` Reviewed By: jvillard Differential Revision: D10451539 fbshipit-source-id: 43be005e4
6 years ago
codetoanalyze/cpp/ownership/use_after_destructor.cpp, FN_placement_new_aliasing1_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `alias` here,accessed `s` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, FN_placement_new_aliasing2_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `s` here,accessed `alias` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, basic_placement_new_ok, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `tptr` here,accessed `ptr` here]
[pulse] Invalidate addresses for destructors Summary: Invalidating addresses for destructors to catch use after destructor errors. To pass ownership tests for use after destructor errors, we still need to: (1) fix pointer arithmetic false positives (2) add model for placement new to fix false positives (3) add model for operator= to fix false positives (4) support inter-procedural analysis for destructor_order_bad test Reviewed By: jvillard Differential Revision: D10450912 fbshipit-source-id: 2d9b1ee68
6 years ago
codetoanalyze/cpp/ownership/use_after_destructor.cpp, destructor_in_loop_ok, 2, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(s)` here,accessed `&(s)` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, double_destructor_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(s)` here,accessed `&(s)` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, reinit_after_explicit_destructor_ok, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(s)` here,accessed `&(s)` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, use_after_destructor_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(s)` here,accessed `*(s.f)` here]
codetoanalyze/cpp/ownership/use_after_destructor.cpp, use_after_scope4_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(c)` here,accessed `pc->f` here]
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
codetoanalyze/cpp/pulse/join.cpp, visit_list, 11, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `result` here,accessed `*(result)` here]
[pulse] rename `Location` -> `Address` and better reporting Summary: `Location` was clashing with the `Location` module, so use `Address` instead. When invalidating an address, remember the "actor" of its invalidation, i.e. the access expression leading to the address and the source location of the corresponding instruction. When checking accesses, also pass the actor responsible for the access, so that when we raise an error we know: 1. when and why a location was invalidated 2. when and why we tried to read it after that Reviewed By: mbouaziz Differential Revision: D10446282 fbshipit-source-id: 3ca4fb3d4
6 years ago
codetoanalyze/cpp/pulse/vector.cpp, deref_vector_element_after_lifetime_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [invalidated `&(x).__internal_array[_]` here,accessed `*(y)` here]