pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2d49f4b7ad'
${ noResults }
infer_clone/infer/tests/codetoanalyze/java/pulse/issues.exp

72 lines
21 KiB
Raw Normal View History Unescape

[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/AnalysisStops.java, codetoanalyze.java.infer.AnalysisStops.accessPathInCalleeMayCauseFalseNegativeBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,when calling `void AnalysisStops.accessPathOnParamOk(AnalysisStops$MyObj)` here,parameter `obj` of void AnalysisStops.accessPathOnParamOk(AnalysisStops$MyObj),assigned,assigned,invalid access occurs here]
codetoanalyze/java/pulse/AnalysisStops.java, codetoanalyze.java.infer.AnalysisStops.fieldReadInCalleeMayCauseFalseNegativeBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,when calling `void AnalysisStops.derefParamOk(AnalysisStops$MyObj)` here,parameter `obj` of void AnalysisStops.derefParamOk(AnalysisStops$MyObj),assigned,invalid access occurs here]
codetoanalyze/java/pulse/AnalysisStops.java, codetoanalyze.java.infer.AnalysisStops.fieldReadInCalleeWithAngelicObjFieldMayCauseFalseNegativeBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,when calling `void AnalysisStops.derefParamOk(AnalysisStops$MyObj)` here,parameter `obj` of void AnalysisStops.derefParamOk(AnalysisStops$MyObj),assigned,invalid access occurs here]
codetoanalyze/java/pulse/Builtins.java, codetoanalyze.java.infer.Builtins.FP_blockErrorIntAssumeOk(java.lang.Object):void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/Builtins.java, codetoanalyze.java.infer.Builtins.FP_blockErrorOk():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/Builtins.java, codetoanalyze.java.infer.Builtins.doNotBlockErrorBad(java.lang.Object):void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/DefaultInInterface.java, DefaultInInterface$A.defaultCallNPE():void, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DefaultInInterface$I.defaultMethod1()`,is the null pointer,returned,return from call to `Object DefaultInInterface$I.defaultMethod1()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DefaultInInterface.java, DefaultInInterface$B.overridenCallNPE():void, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DefaultInInterface$B.defaultMethod2()`,is the null pointer,returned,return from call to `Object DefaultInInterface$B.defaultMethod2()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DefaultInInterface.java, DefaultInInterface.uncertainCallMethod1NPE_latent(int):void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Object DefaultInInterface$I.defaultMethod1()`,is the null pointer,returned,return from call to `Object DefaultInInterface$I.defaultMethod1()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch$WithField.dispatchOnFieldOK_FP():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch$Supertype.bar()`,is the null pointer,returned,return from call to `Object DynamicDispatch$Supertype.bar()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch.FP_dynamicDispatchCallsWrapperWithSubtypeOK():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch.dynamicDispatchWrapperBar(DynamicDispatch$Supertype)`,in call to `Object DynamicDispatch$Supertype.bar()`,is the null pointer,returned,return from call to `Object DynamicDispatch$Supertype.bar()`,assigned,returned,return from call to `Object DynamicDispatch.dynamicDispatchWrapperBar(DynamicDispatch$Supertype)`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch.dynamicDispatchCallsWrapperWithSupertypeBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch.dynamicDispatchWrapperBar(DynamicDispatch$Supertype)`,in call to `Object DynamicDispatch$Supertype.bar()`,is the null pointer,returned,return from call to `Object DynamicDispatch$Supertype.bar()`,assigned,returned,return from call to `Object DynamicDispatch.dynamicDispatchWrapperBar(DynamicDispatch$Supertype)`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch.dynamicDispatchShouldNotCauseFalseNegativeEasyBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch$Subtype.foo()`,is the null pointer,returned,return from call to `Object DynamicDispatch$Subtype.foo()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch.dynamicResolutionWithVariadicMethodBad():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch.variadicMethod(DynamicDispatch$Supertype[])`,is the null pointer,returned,return from call to `Object DynamicDispatch.variadicMethod(DynamicDispatch$Supertype[])`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/DynamicDispatch.java, codetoanalyze.java.infer.DynamicDispatch.interfaceShouldNotCauseFalseNegativeEasyBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object DynamicDispatch$Impl.foo()`,is the null pointer,returned,return from call to `Object DynamicDispatch$Impl.foo()`,assigned,invalid access occurs here]
[pulse] a few textual changes in traces Summary: - Changed "passed as argument to f" to "in call to f", as these do not always correspond to passing an argument (eg could be a value returned from f) - Changed "assigned" to "returned" when appropriate - Changed the model of malloc() to not say "allocated" in the null case - Don't print "returned from f" when there was no event inside f: just print "in call to f". Reviewed By: da319 Differential Revision: D28413900 fbshipit-source-id: bc85625e3
4 years ago
codetoanalyze/java/pulse/HashMapExample.java, codetoanalyze.java.infer.HashMapExample.FP_latent_getFromKeySetOk(java.util.HashMap):void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Map.get()` (modelled),is the null pointer,assigned,in call to `cast` (modelled),assigned,invalid access occurs here]
codetoanalyze/java/pulse/HashMapExample.java, codetoanalyze.java.infer.HashMapExample.getAfterClearBad():void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Map.get()` (modelled),is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/HashMapExample.java, codetoanalyze.java.infer.HashMapExample.getAfterRemovingTheKeyBad():void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Map.get()` (modelled),is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/HashMapExample.java, codetoanalyze.java.infer.HashMapExample.getOneIntegerWithoutCheckBad():int, 6, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Map.get()` (modelled),is the null pointer,assigned,in call to `cast` (modelled),assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/InstanceOfExample.java, InstanceOfExample.checkInstanceArray(java.lang.Object):void, 7, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,invalid access occurs here]
[pulse] correct order of calling context in trace Summary: The order was reversed when printing the trace, leading to confusion. Also make sure we indicate which part of the trace we are printing when there is more than one part (either context + access or invalidation + access, or all three). Also start nesting at <calling context length> to better represent the role of the calling context visually. Reviewed By: da319 Differential Revision: D28329263 fbshipit-source-id: b691fb1f4
4 years ago
codetoanalyze/java/pulse/InstanceOfExample.java, InstanceOfExample.testInstanceOfBooleanArrayBad():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [calling context starts here,in call to `void InstanceOfExample.checkInstanceArray(Object)`,null pointer dereference part of the trace starts here,is the null pointer,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/InstanceOfExample.java, InstanceOfExample.testInstanceOfNullIntraBad():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/InstanceOfExample.java, InstanceOfExample.testInstanceOfObjProfessorBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `InstanceOfExample$Person InstanceOfExample.updatePerson(InstanceOfExample$Person)`,is the null pointer,assigned,returned,return from call to `InstanceOfExample$Person InstanceOfExample.updatePerson(InstanceOfExample$Person)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/IntegerExample.java, codetoanalyze.java.infer.IntegerExample.FP_testIntegerBuiltInEqualOperatorCachedValuesOk():void, 19, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/IntegerExample.java, codetoanalyze.java.infer.IntegerExample.testIntegerBuiltInEqualOperatorNonCachedValuesBad():void, 7, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/IntegerExample.java, codetoanalyze.java.infer.IntegerExample.testIntegerEqualsMethodBad():void, 6, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/IntegerExample.java, codetoanalyze.java.infer.IntegerExample.testIntegerEqualsMethodMaxValueBad():void, 6, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/InvokeDynamic.java, codetoanalyze.java.infer.InvokeDynamic.invokeDynamicThenNpeBad(java.util.List):void, 7, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/InvokeDynamic.java, codetoanalyze.java.infer.InvokeDynamic.lambda$npeInLambdaBad$1(java.lang.String,java.lang.String):int, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.FN_latent_removeInvalidatesNonEmptinessNPEBad(java.util.List):void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.FP_removeOnEmptyListOk():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object Lists.getElement(List)`,is the null pointer,assigned,returned,return from call to `Object Lists.getElement(List)`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.addAndRemoveEmptinessNPEBad():void, 6, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object Lists.getElement(List)`,is the null pointer,assigned,returned,return from call to `Object Lists.getElement(List)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.addInvalidatesEmptinessNPEBad(java.util.List):void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.clearCausesEmptinessNPEBad(java.util.List):void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.getElementNPEBad():void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object Lists.getElement(List)`,is the null pointer,assigned,returned,return from call to `Object Lists.getElement(List)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/Lists.java, codetoanalyze.java.infer.Lists.removeElementBad():void, 7, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions$$$Class$Name$With$Dollars.npeWithDollars():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.FP_otherSinkWithNeverNullSource():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `T SomeLibrary.get()`,is the null pointer,assigned,returned,return from call to `T SomeLibrary.get()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.FP_sinkWithNeverNullSource():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `T NeverNullSource.get()`,is the null pointer,assigned,returned,return from call to `T NeverNullSource.get()`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.FP_stringConstantEqualsTrueNotNPE():void, 7, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.FP_stringConstantEqualsTrueNotNPE():void, 12, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] a few textual changes in traces Summary: - Changed "passed as argument to f" to "in call to f", as these do not always correspond to passing an argument (eg could be a value returned from f) - Changed "assigned" to "returned" when appropriate - Changed the model of malloc() to not say "allocated" in the null case - Don't print "returned from f" when there was no event inside f: just print "in call to f". Reviewed By: da319 Differential Revision: D28413900 fbshipit-source-id: bc85625e3
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.NPEvalueOfFromHashmapBad(java.util.HashMap,int):int, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Map.get()` (modelled),is the null pointer,assigned,in call to `cast` (modelled),invalid access occurs here]
[pulse] functional unknown functions Summary: Unknown functions may create false positives as well as false negatives for Pulse. Let's consider that unknown functions behave "functionally", or at least that a functional behaviour is a possible behaviour for them: when called with the same parameter values, they should return the same value. This is implemented purely in the arithmetic domain by recording `v_return = f_unknown(v1, v2, ..., vN)` for each call to unknown functions `f_unknown` with values `v1`, `v2`, ..., `vN` (and return `v_return`). The hope is that this will create more false negatives than false positives, as several FPs have been observed on real code that would be suppressed with this heuristic. The other effect this has on reports is to record hypotheses made on the return values of unknown functions into the "pruned" part of formulas, which inhibits reporting on paths whose feasibility depends on the return value of unknown functions (by making these issues latent instead). This should allow us to control the amount of FPs until we model more functions. Reviewed By: skcho Differential Revision: D27798275 fbshipit-source-id: d31cfb8b6
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.badCheckShouldCauseNPE_latent():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Object NullPointerExceptions.getObj()`,is the null pointer,returned,return from call to `Object NullPointerExceptions.getObj()`,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.derefNull():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object NullPointerExceptions.derefUndefinedCallee()`,is the null pointer,returned,return from call to `Object NullPointerExceptions.derefUndefinedCallee()`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.derefNullableRet(boolean):void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Object NullPointerExceptions.nullableRet(boolean)`,is the null pointer,returned,return from call to `Object NullPointerExceptions.nullableRet(boolean)`,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.dereferenceAfterLoopOnList(codetoanalyze.java.infer.NullPointerExceptions$L):void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Object NullPointerExceptions.returnsNullAfterLoopOnList(NullPointerExceptions$L)`,is the null pointer,returned,return from call to `Object NullPointerExceptions.returnsNullAfterLoopOnList(NullPointerExceptions$L)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.dereferenceAfterUnlock1(java.util.concurrent.locks.Lock):void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.dereferenceAfterUnlock2(java.util.concurrent.locks.Lock):void, 6, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] a few textual changes in traces Summary: - Changed "passed as argument to f" to "in call to f", as these do not always correspond to passing an argument (eg could be a value returned from f) - Changed "assigned" to "returned" when appropriate - Changed the model of malloc() to not say "allocated" in the null case - Don't print "returned from f" when there was no event inside f: just print "in call to f". Reviewed By: da319 Differential Revision: D28413900 fbshipit-source-id: bc85625e3
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.hashmapNPE(java.util.HashMap,java.lang.Object):java.lang.String, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,in call to `Map.get()` (modelled),is the null pointer,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerException():int, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionArrayLength():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionCallArrayReadMethod():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `Object NullPointerExceptions.arrayReadShouldNotCauseSymexMemoryError(int)`,is the null pointer,returned,return from call to `Object NullPointerExceptions.arrayReadShouldNotCauseSymexMemoryError(int)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionInArrayLengthLoop(java.lang.Object[]):void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionInterProc():int, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `NullPointerExceptions$A NullPointerExceptions.canReturnNullObject(boolean)`,is the null pointer,returned,return from call to `NullPointerExceptions$A NullPointerExceptions.canReturnNullObject(boolean)`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionUnlessFrameFails():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionWithArray():int, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionWithNullArrayParameter():void, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,when calling `void NullPointerExceptions.expectNotNullArrayParameter(NullPointerExceptions$A[])` here,parameter `array` of void NullPointerExceptions.expectNotNullArrayParameter(NullPointerExceptions$A[]),invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.nullPointerExceptionWithNullObjectParameter():void, 1, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,when calling `void NullPointerExceptions.expectNotNullObjectParameter(NullPointerExceptions$A)` here,parameter `a` of void NullPointerExceptions.expectNotNullObjectParameter(NullPointerExceptions$A),invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.someNPEAfterResourceLeak():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `T CloseableAsResourceExample.sourceOfNullWithResourceLeak()`,is the null pointer,returned,return from call to `T CloseableAsResourceExample.sourceOfNullWithResourceLeak()`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.stringConstantEqualsFalseNotNPE_FP():void, 10, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/NullPointerExceptions.java, codetoanalyze.java.infer.NullPointerExceptions.stringVarEqualsFalseNPE():void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] follow values inside function calls Summary: Turns out the mistake was pretty simple: we just forgot to keep the history of the return value in the callee and add it to the caller's. Reviewed By: skcho Differential Revision: D28385941 fbshipit-source-id: 40fe09c99
4 years ago
codetoanalyze/java/pulse/NullSafeExample.java, OtherClass.buggyMethodBad():java.lang.String, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [in call to `OtherClass.<init>()`,is the null pointer,assigned,return from call to `OtherClass.<init>()`,in call to `OtherClass OtherClass.canReturnNull()`,parameter `this` of OtherClass OtherClass.canReturnNull(),returned,return from call to `OtherClass OtherClass.canReturnNull()`,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/PreconditionsExample.java, codetoanalyze.java.infer.PreconditionsExample.checkArgumentSatBad():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/PreconditionsExample.java, codetoanalyze.java.infer.PreconditionsExample.checkStateConditionSatBad():void, 5, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/PreconditionsExample.java, codetoanalyze.java.infer.PreconditionsExample.testCheckNotNullArgLatent(java.lang.Object):void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/SuppressLintExample.java, codetoanalyze.java.infer.SuppressAllWarnigsInTheClass.shouldNotReportNPE():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/SuppressLintExample.java, codetoanalyze.java.infer.SuppressLintExample.shouldReportNPE():void, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/TextUtilsExample.java, TextUtilsExample.FP_testTextUtilsIsEmptyOk(java.lang.String):void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,invalid access occurs here]
codetoanalyze/java/pulse/TextUtilsExample.java, TextUtilsExample.testTextUtilsIsEmptyBad():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] Revise semantics of TextUtils.is_empty Summary: There are two changes: 1/ Fix incorrect merge of two cases (empty and not-empty) ``` let<*> astate_equal_zero = ... in let<*> astate_not_zero = ... in [Ok (ContinueProgram astate_equal_zero); Ok (ContinueProgram astate_not_zero)] ``` This was an incorrect merge, because if there is an error in the former case `astate_equal_zero`, it doesn't even evaluate the latter case `astate_not_zero`. 2/ Cover all cases precisely. There are actually three cases to cover: * `TextUtils.is_empty(null) = true` * `TextUtils.is_empty("") = true` * `TextUtils.is_empty("abc") = false` However, in the previous model, it missed the second case. Reviewed By: jvillard Differential Revision: D29393579 fbshipit-source-id: e59d9a60d
3 years ago
codetoanalyze/java/pulse/TextUtilsExample.java, TextUtilsExample.testTextUtilsIsEmptyEmptyStrBad():void, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/java/pulse/TextUtilsExample.java, TextUtilsExample.testTextUtilsIsEmptyNullBad():void, 4, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]