pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '4697b22fb4'
${ noResults }
infer_clone/infer/tests/codetoanalyze/c/frontend/switchstmt/switch.c.dot

765 lines
59 KiB
Raw Normal View History Unescape

Add @generated comment to icfg.dot files Reviewed By: jvillard Differential Revision: D3358243 fbshipit-source-id: a47cc01
9 years ago
/* @generated */
[cfg] rename iCFG to cfg in dotty files Summary: Not sure what an "iCFG" is but the dotty is only about CFGs anyway. Diff obtained by mass-`sed`. Reviewed By: sblackshear Differential Revision: D6324280 fbshipit-source-id: b7603bb
7 years ago
digraph cfg {
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"getValue.faa0c7b1433b0c97fcdc15fa47c8180f_1" [label="1: Start getValue\nFormals: \nLocals: \n " color=yellow style=filled]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
"getValue.faa0c7b1433b0c97fcdc15fa47c8180f_1" -> "getValue.faa0c7b1433b0c97fcdc15fa47c8180f_3" ;
"getValue.faa0c7b1433b0c97fcdc15fa47c8180f_2" [label="2: Exit getValue \n " color=yellow style=filled]
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"getValue.faa0c7b1433b0c97fcdc15fa47c8180f_3" [label="3: Return Stmt \n *&return:int=1 [line 134, column 18]\n APPLY_ABSTRACTION; [line 134, column 18]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
"getValue.faa0c7b1433b0c97fcdc15fa47c8180f_3" -> "getValue.faa0c7b1433b0c97fcdc15fa47c8180f_2" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_1" [label="1: Start test_switch1\nFormals: \nLocals: x:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_1" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_22" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_2" [label="2: Exit test_switch1 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_3" [label="3: Return Stmt \n *&return:int=0 [line 33, column 3]\n APPLY_ABSTRACTION; [line 33, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_3" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_2" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" [label="4: + \n " ]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_5" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_5" [label="5: BinaryOperatorStmt: LT \n n$0=*&value:int [line 13, column 10]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_5" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_6" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_5" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_7" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_6" [label="6: Prune (true branch, while) \n PRUNE((n$0 < 10), true); [line 13, column 10]\n EXIT_SCOPE(n$0); [line 13, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_6" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_9" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_7" [label="7: Prune (false branch, while) \n PRUNE(!(n$0 < 10), false); [line 13, column 10]\n NULLIFY(&value); [line 13, column 10]\n EXIT_SCOPE(n$0,value); [line 13, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_7" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_8" [label="8: Call _fun_printf \n n$1=_fun_printf((char const *)\"(after_switch)HELLO WORLD!\":char const *) [line 31, column 5]\n EXIT_SCOPE(n$1); [line 31, column 5]\n APPLY_ABSTRACTION; [line 31, column 5]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_8" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_9" [label="9: SwitchStmt \n n$2=*&value:int [line 14, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_9" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_20" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_9" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_21" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_10" [label="10: Call _fun_printf \n n$4=_fun_printf((char const *)\"(2/def)HELLO WORLD!\":char const *) [line 28, column 9]\n EXIT_SCOPE(n$4); [line 28, column 9]\n APPLY_ABSTRACTION; [line 28, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_10" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_11" [label="11: Call _fun_printf \n n$6=_fun_printf((char const *)\"(1)HELLO WORLD!\":char const *) [line 24, column 9]\n EXIT_SCOPE(n$6); [line 24, column 9]\n APPLY_ABSTRACTION; [line 24, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_11" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_12" [label="12: Call _fun_printf \n n$8=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 21, column 9]\n EXIT_SCOPE(n$8); [line 21, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_12" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_8" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_13" [label="13: BinaryOperatorStmt: Assign \n n$9=*&value:int [line 19, column 11]\n *&x:int=(n$9 + 1) [line 19, column 7]\n APPLY_ABSTRACTION; [line 19, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_13" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_12" ;
[infer] Translate casting expressions of integer pointers Summary: It enables the translation of casting expression. As of now, it translates only the castings of pointers to integer types, in order to avoid too much of change, which may mess the checkers up. Reviewed By: jvillard Differential Revision: D12920568 fbshipit-source-id: a5489df24
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_14" [label="14: Call _fun_printf \n n$10=_fun_printf((char const *)\"(out)HELLO WORLD!\":char const *) [line 18, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_14" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_13" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_15" [label="15: DeclStmt \n VARIABLE_DECLARED(x:int); [line 17, column 7]\n *&x:int=1 [line 17, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_15" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_14" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_16" [label="16: Prune (true branch, switch) \n PRUNE((n$2 == 2), true); [line 26, column 7]\n EXIT_SCOPE(n$2); [line 26, column 7]\n APPLY_ABSTRACTION; [line 26, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_16" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_17" [label="17: Prune (false branch, switch) \n PRUNE(!(n$2 == 2), false); [line 26, column 7]\n EXIT_SCOPE(n$2); [line 26, column 7]\n APPLY_ABSTRACTION; [line 26, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_17" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_18" [label="18: Prune (true branch, switch) \n PRUNE((n$2 == 1), true); [line 23, column 7]\n EXIT_SCOPE(n$2); [line 23, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_18" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_11" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_19" [label="19: Prune (false branch, switch) \n PRUNE(!(n$2 == 1), false); [line 23, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_19" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_16" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_19" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_17" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_20" [label="20: Prune (true branch, switch) \n PRUNE((n$2 == 0), true); [line 20, column 7]\n EXIT_SCOPE(n$2); [line 20, column 7]\n APPLY_ABSTRACTION; [line 20, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_20" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_12" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_21" [label="21: Prune (false branch, switch) \n PRUNE(!(n$2 == 0), false); [line 20, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_21" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_18" ;
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_21" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_19" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_22" [label="22: DeclStmt \n VARIABLE_DECLARED(value:int); [line 11, column 3]\n *&value:int=0 [line 11, column 3]\n APPLY_ABSTRACTION; [line 11, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_22" -> "test_switch1.7c92c7e14d1a0ee28a9ab29b22df5d3f_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_1" [label="1: Start test_switch10\nFormals: \nLocals: value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_1" -> "test_switch10.8a4170d3888102a2491712a5ad55ad8d_5" ;
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_2" [label="2: Exit test_switch10 \n " color=yellow style=filled]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_3" [label="3: Return Stmt \n *&return:int=0 [line 185, column 3]\n APPLY_ABSTRACTION; [line 185, column 3]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_3" -> "test_switch10.8a4170d3888102a2491712a5ad55ad8d_2" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_4" [label="4: SwitchStmt \n *&value:int=7 [line 184, column 11]\n n$0=*&value:int [line 184, column 11]\n NULLIFY(&value); [line 184, column 11]\n EXIT_SCOPE(n$0,value); [line 184, column 11]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_4" -> "test_switch10.8a4170d3888102a2491712a5ad55ad8d_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_5" [label="5: DeclStmt \n VARIABLE_DECLARED(value:int); [line 183, column 3]\n *&value:int=0 [line 183, column 3]\n NULLIFY(&value); [line 183, column 3]\n EXIT_SCOPE(value); [line 183, column 3]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch10.8a4170d3888102a2491712a5ad55ad8d_5" -> "test_switch10.8a4170d3888102a2491712a5ad55ad8d_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_1" [label="1: Start test_switch11\nFormals: \nLocals: 0$?%__sil_tmpSIL_temp_conditional___n$0:int value:int \n " color=yellow style=filled]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_1" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_14" ;
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_2" [label="2: Exit test_switch11 \n " color=yellow style=filled]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_3" [label="3: Return Stmt \n *&return:int=0 [line 194, column 3]\n APPLY_ABSTRACTION; [line 194, column 3]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_3" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_2" ;
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_4" [label="4: + \n " ]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_4" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_5" [label="5: BinaryOperatorStmt: EQ \n n$1=*&value:int [line 190, column 20]\n NULLIFY(&value); [line 190, column 20]\n EXIT_SCOPE(value); [line 190, column 20]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_5" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_6" ;
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_5" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_7" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_6" [label="6: Prune (true branch, boolean exp) \n PRUNE((n$1 == 0), true); [line 190, column 20]\n EXIT_SCOPE(n$1); [line 190, column 20]\n " shape="invhouse"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_6" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_8" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_7" [label="7: Prune (false branch, boolean exp) \n PRUNE(!(n$1 == 0), false); [line 190, column 20]\n EXIT_SCOPE(n$1); [line 190, column 20]\n " shape="invhouse"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_7" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_9" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_8" [label="8: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$0:int=7 [line 190, column 20]\n APPLY_ABSTRACTION; [line 190, column 20]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_8" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_4" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_9" [label="9: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$0:int=9 [line 190, column 20]\n APPLY_ABSTRACTION; [line 190, column 20]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_9" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_4" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_10" [label="10: SwitchStmt \n n$2=*&0$?%__sil_tmpSIL_temp_conditional___n$0:int [line 190, column 20]\n *&value:int=n$2 [line 190, column 11]\n n$3=*&value:int [line 190, column 11]\n NULLIFY(&value); [line 190, column 11]\n NULLIFY(&0$?%__sil_tmpSIL_temp_conditional___n$0); [line 190, column 11]\n EXIT_SCOPE(n$2,value,0$?%__sil_tmpSIL_temp_conditional___n$0); [line 190, column 11]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_10" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_12" ;
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_10" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_13" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_11" [label="11: Call _fun_printf \n n$4=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 192, column 7]\n EXIT_SCOPE(n$4); [line 192, column 7]\n APPLY_ABSTRACTION; [line 192, column 7]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_11" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_12" [label="12: Prune (true branch, switch) \n PRUNE((n$3 == 0), true); [line 191, column 5]\n EXIT_SCOPE(n$3); [line 191, column 5]\n " shape="invhouse"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_12" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_11" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_13" [label="13: Prune (false branch, switch) \n PRUNE(!(n$3 == 0), false); [line 191, column 5]\n EXIT_SCOPE(n$3); [line 191, column 5]\n APPLY_ABSTRACTION; [line 191, column 5]\n " shape="invhouse"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_13" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_14" [label="14: DeclStmt \n VARIABLE_DECLARED(value:int); [line 189, column 3]\n *&value:int=0 [line 189, column 3]\n " shape="box"]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_14" -> "test_switch11.a1a6d859e414d268a57ed2a2bb6f8a8e_5" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_1" [label="1: Start test_switch2\nFormals: \nLocals: something:int z:int x:int value:int \n " color=yellow style=filled]
[debug] print procedures in alphabetical order in cfgs Summary: When looking at large CFGs, at least in `xdot`, it's often difficult to find the procedure you're looking for. Sorting the proc names puts them in alphabetical order, which makes searching one procedure easier. Reviewed By: mbouaziz Differential Revision: D7758521 fbshipit-source-id: 8e9997f
7 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_1" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_18" ;
"test_switch2.0717c55583f10f472ddb2d73d867e556_2" [label="2: Exit test_switch2 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_3" [label="3: Return Stmt \n *&return:int=0 [line 56, column 3]\n APPLY_ABSTRACTION; [line 56, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_3" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_2" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_4" [label="4: SwitchStmt \n n$0=*&value:int [line 38, column 11]\n NULLIFY(&value); [line 38, column 11]\n EXIT_SCOPE(value); [line 38, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_4" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_16" ;
"test_switch2.0717c55583f10f472ddb2d73d867e556_4" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_17" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_5" [label="5: BinaryOperatorStmt: Assign \n *&z:int=42 [line 50, column 7]\n NULLIFY(&z); [line 50, column 7]\n EXIT_SCOPE(z); [line 50, column 7]\n APPLY_ABSTRACTION; [line 50, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_5" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_6" [label="6: UnaryOperator \n n$3=*&something:int [line 48, column 7]\n *&something:int=(n$3 + 1) [line 48, column 7]\n NULLIFY(&something); [line 48, column 7]\n EXIT_SCOPE(n$3,something); [line 48, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_6" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_5" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_7" [label="7: DeclStmt \n VARIABLE_DECLARED(something:int); [line 47, column 7]\n *&something:int=1 [line 47, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_7" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_6" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_8" [label="8: DeclStmt \n VARIABLE_DECLARED(z:int); [line 43, column 7]\n *&z:int=9 [line 43, column 7]\n APPLY_ABSTRACTION; [line 43, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_8" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_7" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_9" [label="9: Call _fun_printf \n n$5=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 41, column 7]\n EXIT_SCOPE(n$5); [line 41, column 7]\n APPLY_ABSTRACTION; [line 41, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_9" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_10" [label="10: Prune (true branch, switch) \n PRUNE((n$0 == 3), true); [line 53, column 5]\n APPLY_ABSTRACTION; [line 53, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_10" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_11" [label="11: Prune (false branch, switch) \n PRUNE(!(n$0 == 3), false); [line 53, column 5]\n APPLY_ABSTRACTION; [line 53, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_11" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_12" [label="12: Prune (true branch, switch) \n PRUNE((n$0 == 2), true); [line 52, column 5]\n APPLY_ABSTRACTION; [line 52, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_12" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_13" [label="13: Prune (false branch, switch) \n PRUNE(!(n$0 == 2), false); [line 52, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_13" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_10" ;
"test_switch2.0717c55583f10f472ddb2d73d867e556_13" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_11" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_14" [label="14: Prune (true branch, switch) \n PRUNE((n$0 == 1), true); [line 46, column 5]\n APPLY_ABSTRACTION; [line 46, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_14" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_7" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_15" [label="15: Prune (false branch, switch) \n PRUNE(!(n$0 == 1), false); [line 46, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_15" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_12" ;
"test_switch2.0717c55583f10f472ddb2d73d867e556_15" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_13" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_16" [label="16: Prune (true branch, switch) \n PRUNE((n$0 == 0), true); [line 40, column 5]\n EXIT_SCOPE(n$0); [line 40, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_16" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_9" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_17" [label="17: Prune (false branch, switch) \n PRUNE(!(n$0 == 0), false); [line 40, column 5]\n EXIT_SCOPE(n$0); [line 40, column 5]\n APPLY_ABSTRACTION; [line 40, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_17" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_7" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_18" [label="18: DeclStmt \n VARIABLE_DECLARED(value:int); [line 37, column 3]\n *&value:int=0 [line 37, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch2.0717c55583f10f472ddb2d73d867e556_18" -> "test_switch2.0717c55583f10f472ddb2d73d867e556_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_1" [label="1: Start test_switch3\nFormals: \nLocals: z:int something:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_1" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_17" ;
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_2" [label="2: Exit test_switch3 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" [label="3: Return Stmt \n *&return:int=0 [line 74, column 3]\n APPLY_ABSTRACTION; [line 74, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_2" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_4" [label="4: SwitchStmt \n n$0=*&value:int [line 61, column 11]\n NULLIFY(&value); [line 61, column 11]\n EXIT_SCOPE(value); [line 61, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_4" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_15" ;
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_4" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_16" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_5" [label="5: DeclStmt \n VARIABLE_DECLARED(z:int); [line 69, column 7]\n *&z:int=9 [line 69, column 7]\n APPLY_ABSTRACTION; [line 69, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_5" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_6" [label="6: UnaryOperator \n n$3=*&something:int [line 67, column 7]\n *&something:int=(n$3 + 1) [line 67, column 7]\n NULLIFY(&something); [line 67, column 7]\n EXIT_SCOPE(n$3,something); [line 67, column 7]\n APPLY_ABSTRACTION; [line 67, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_6" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_7" [label="7: DeclStmt \n VARIABLE_DECLARED(something:int); [line 66, column 7]\n *&something:int=1 [line 66, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_7" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_6" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_8" [label="8: Call _fun_printf \n n$5=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 63, column 7]\n EXIT_SCOPE(n$5); [line 63, column 7]\n APPLY_ABSTRACTION; [line 63, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_8" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_9" [label="9: Prune (true branch, switch) \n PRUNE((n$0 == 3), true); [line 71, column 5]\n EXIT_SCOPE(n$0); [line 71, column 5]\n APPLY_ABSTRACTION; [line 71, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_9" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_10" [label="10: Prune (false branch, switch) \n PRUNE(!(n$0 == 3), false); [line 71, column 5]\n EXIT_SCOPE(n$0); [line 71, column 5]\n APPLY_ABSTRACTION; [line 71, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_10" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_11" [label="11: Prune (true branch, switch) \n PRUNE((n$0 == 2), true); [line 70, column 5]\n EXIT_SCOPE(n$0); [line 70, column 5]\n APPLY_ABSTRACTION; [line 70, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_11" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_12" [label="12: Prune (false branch, switch) \n PRUNE(!(n$0 == 2), false); [line 70, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_12" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_9" ;
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_12" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_13" [label="13: Prune (true branch, switch) \n PRUNE((n$0 == 1), true); [line 65, column 5]\n EXIT_SCOPE(n$0); [line 65, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_13" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_7" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_14" [label="14: Prune (false branch, switch) \n PRUNE(!(n$0 == 1), false); [line 65, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_14" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_11" ;
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_14" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_12" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_15" [label="15: Prune (true branch, switch) \n PRUNE((n$0 == 0), true); [line 62, column 5]\n EXIT_SCOPE(n$0); [line 62, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_15" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_8" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_16" [label="16: Prune (false branch, switch) \n PRUNE(!(n$0 == 0), false); [line 62, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_16" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_13" ;
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_16" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_14" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_17" [label="17: DeclStmt \n VARIABLE_DECLARED(value:int); [line 60, column 3]\n *&value:int=0 [line 60, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch3.d602e3f7cc0068667fd33a3e54ff193c_17" -> "test_switch3.d602e3f7cc0068667fd33a3e54ff193c_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_1" [label="1: Start test_switch4\nFormals: \nLocals: something:int z:int x:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_1" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_18" ;
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_2" [label="2: Exit test_switch4 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" [label="3: Return Stmt \n *&return:int=0 [line 97, column 3]\n APPLY_ABSTRACTION; [line 97, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_2" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_4" [label="4: SwitchStmt \n n$0=*&value:int [line 79, column 11]\n NULLIFY(&value); [line 79, column 11]\n EXIT_SCOPE(value); [line 79, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_4" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_16" ;
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_4" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_17" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_5" [label="5: BinaryOperatorStmt: Assign \n *&z:int=42 [line 91, column 7]\n NULLIFY(&z); [line 91, column 7]\n EXIT_SCOPE(z); [line 91, column 7]\n APPLY_ABSTRACTION; [line 91, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_5" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_6" [label="6: UnaryOperator \n n$3=*&something:int [line 89, column 7]\n *&something:int=(n$3 + 1) [line 89, column 7]\n NULLIFY(&something); [line 89, column 7]\n EXIT_SCOPE(n$3,something); [line 89, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_6" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_5" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_7" [label="7: DeclStmt \n VARIABLE_DECLARED(something:int); [line 88, column 7]\n *&something:int=1 [line 88, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_7" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_6" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_8" [label="8: DeclStmt \n VARIABLE_DECLARED(z:int); [line 84, column 7]\n *&z:int=9 [line 84, column 7]\n APPLY_ABSTRACTION; [line 84, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_8" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_7" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_9" [label="9: Call _fun_printf \n n$5=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 82, column 7]\n EXIT_SCOPE(n$5); [line 82, column 7]\n APPLY_ABSTRACTION; [line 82, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_9" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_10" [label="10: Prune (true branch, switch) \n PRUNE((n$0 == 3), true); [line 94, column 5]\n APPLY_ABSTRACTION; [line 94, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_10" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_11" [label="11: Prune (false branch, switch) \n PRUNE(!(n$0 == 3), false); [line 94, column 5]\n APPLY_ABSTRACTION; [line 94, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_11" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_12" [label="12: Prune (true branch, switch) \n PRUNE((n$0 == 2), true); [line 93, column 5]\n APPLY_ABSTRACTION; [line 93, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_12" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_13" [label="13: Prune (false branch, switch) \n PRUNE(!(n$0 == 2), false); [line 93, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_13" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_10" ;
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_13" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_11" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_14" [label="14: Prune (true branch, switch) \n PRUNE((n$0 == 1), true); [line 87, column 5]\n APPLY_ABSTRACTION; [line 87, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_14" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_7" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_15" [label="15: Prune (false branch, switch) \n PRUNE(!(n$0 == 1), false); [line 87, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_15" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_12" ;
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_15" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_13" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_16" [label="16: Prune (true branch, switch) \n PRUNE((n$0 == 0), true); [line 81, column 5]\n EXIT_SCOPE(n$0); [line 81, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_16" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_9" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_17" [label="17: Prune (false branch, switch) \n PRUNE(!(n$0 == 0), false); [line 81, column 5]\n EXIT_SCOPE(n$0); [line 81, column 5]\n APPLY_ABSTRACTION; [line 81, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_17" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_7" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_18" [label="18: DeclStmt \n VARIABLE_DECLARED(value:int); [line 78, column 3]\n *&value:int=0 [line 78, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_18" -> "test_switch4.70d4e6e8539e8d1ee3505d4562bc236d_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_1" [label="1: Start test_switch5\nFormals: \nLocals: x:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_1" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_14" ;
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_2" [label="2: Exit test_switch5 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_3" [label="3: Return Stmt \n *&return:int=0 [line 113, column 3]\n APPLY_ABSTRACTION; [line 113, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_3" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_2" ;
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" [label="4: + \n " ]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_5" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_5" [label="5: BinaryOperatorStmt: LT \n n$0=*&value:int [line 102, column 10]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_5" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_6" ;
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_5" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_7" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_6" [label="6: Prune (true branch, while) \n PRUNE((n$0 < 10), true); [line 102, column 10]\n EXIT_SCOPE(n$0); [line 102, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_6" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_8" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_7" [label="7: Prune (false branch, while) \n PRUNE(!(n$0 < 10), false); [line 102, column 10]\n NULLIFY(&value); [line 102, column 10]\n EXIT_SCOPE(n$0,value); [line 102, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_7" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_8" [label="8: SwitchStmt \n n$1=*&value:int [line 103, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_8" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_12" ;
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_8" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_13" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_9" [label="9: Call _fun_printf \n n$3=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 109, column 9]\n EXIT_SCOPE(n$3); [line 109, column 9]\n APPLY_ABSTRACTION; [line 109, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_9" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_10" [label="10: BinaryOperatorStmt: Assign \n n$5=*&value:int [line 106, column 11]\n *&x:int=(n$5 + 1) [line 106, column 7]\n APPLY_ABSTRACTION; [line 106, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_10" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" ;
[infer] Translate casting expressions of integer pointers Summary: It enables the translation of casting expression. As of now, it translates only the castings of pointers to integer types, in order to avoid too much of change, which may mess the checkers up. Reviewed By: jvillard Differential Revision: D12920568 fbshipit-source-id: a5489df24
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_11" [label="11: Call _fun_printf \n n$6=_fun_printf((char const *)\"(out)HELLO WORLD!\":char const *) [line 105, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_11" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_12" [label="12: Prune (true branch, switch) \n PRUNE((n$1 == 0), true); [line 108, column 7]\n EXIT_SCOPE(n$1); [line 108, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_12" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_9" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_13" [label="13: Prune (false branch, switch) \n PRUNE(!(n$1 == 0), false); [line 108, column 7]\n EXIT_SCOPE(n$1); [line 108, column 7]\n APPLY_ABSTRACTION; [line 108, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_13" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_14" [label="14: DeclStmt \n VARIABLE_DECLARED(value:int); [line 101, column 3]\n *&value:int=0 [line 101, column 3]\n APPLY_ABSTRACTION; [line 101, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch5.1d93fcc376cd01517eabe22cb325bcfd_14" -> "test_switch5.1d93fcc376cd01517eabe22cb325bcfd_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_1" [label="1: Start test_switch6\nFormals: \nLocals: 0$?%__sil_tmpSIL_temp_conditional___n$0:int z:int something:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_1" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_23" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_2" [label="2: Exit test_switch6 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_3" [label="3: Return Stmt \n *&return:int=0 [line 131, column 3]\n APPLY_ABSTRACTION; [line 131, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_3" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_2" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_4" [label="4: + \n " ]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_4" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_5" [label="5: BinaryOperatorStmt: GT \n n$1=*&value:int [line 118, column 11]\n NULLIFY(&value); [line 118, column 11]\n EXIT_SCOPE(value); [line 118, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_5" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_6" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_5" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_7" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_6" [label="6: Prune (true branch, boolean exp) \n PRUNE((n$1 > 0), true); [line 118, column 11]\n EXIT_SCOPE(n$1); [line 118, column 11]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_6" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_8" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_7" [label="7: Prune (false branch, boolean exp) \n PRUNE(!(n$1 > 0), false); [line 118, column 11]\n EXIT_SCOPE(n$1); [line 118, column 11]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_7" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_9" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_8" [label="8: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$0:int=1 [line 118, column 11]\n APPLY_ABSTRACTION; [line 118, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_8" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_4" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_9" [label="9: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$0:int=0 [line 118, column 11]\n APPLY_ABSTRACTION; [line 118, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_9" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_4" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_10" [label="10: SwitchStmt \n n$2=*&0$?%__sil_tmpSIL_temp_conditional___n$0:int [line 118, column 11]\n NULLIFY(&0$?%__sil_tmpSIL_temp_conditional___n$0); [line 118, column 11]\n EXIT_SCOPE(0$?%__sil_tmpSIL_temp_conditional___n$0); [line 118, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_10" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_21" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_10" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_22" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_11" [label="11: DeclStmt \n VARIABLE_DECLARED(z:int); [line 126, column 7]\n *&z:int=9 [line 126, column 7]\n APPLY_ABSTRACTION; [line 126, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_11" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_12" [label="12: UnaryOperator \n n$5=*&something:int [line 124, column 7]\n *&something:int=(n$5 + 1) [line 124, column 7]\n NULLIFY(&something); [line 124, column 7]\n EXIT_SCOPE(n$5,something); [line 124, column 7]\n APPLY_ABSTRACTION; [line 124, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_12" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_13" [label="13: DeclStmt \n VARIABLE_DECLARED(something:int); [line 123, column 7]\n *&something:int=1 [line 123, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_13" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_12" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_14" [label="14: Call _fun_printf \n n$7=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 120, column 7]\n EXIT_SCOPE(n$7); [line 120, column 7]\n APPLY_ABSTRACTION; [line 120, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_14" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_15" [label="15: Prune (true branch, switch) \n PRUNE((n$2 == 3), true); [line 128, column 5]\n EXIT_SCOPE(n$2); [line 128, column 5]\n APPLY_ABSTRACTION; [line 128, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_15" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_16" [label="16: Prune (false branch, switch) \n PRUNE(!(n$2 == 3), false); [line 128, column 5]\n EXIT_SCOPE(n$2); [line 128, column 5]\n APPLY_ABSTRACTION; [line 128, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_16" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_17" [label="17: Prune (true branch, switch) \n PRUNE((n$2 == 2), true); [line 127, column 5]\n EXIT_SCOPE(n$2); [line 127, column 5]\n APPLY_ABSTRACTION; [line 127, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_17" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_18" [label="18: Prune (false branch, switch) \n PRUNE(!(n$2 == 2), false); [line 127, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_18" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_15" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_18" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_16" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_19" [label="19: Prune (true branch, switch) \n PRUNE((n$2 == 1), true); [line 122, column 5]\n EXIT_SCOPE(n$2); [line 122, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_19" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_13" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_20" [label="20: Prune (false branch, switch) \n PRUNE(!(n$2 == 1), false); [line 122, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_20" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_17" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_20" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_18" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_21" [label="21: Prune (true branch, switch) \n PRUNE((n$2 == 0), true); [line 119, column 5]\n EXIT_SCOPE(n$2); [line 119, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_21" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_14" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_22" [label="22: Prune (false branch, switch) \n PRUNE(!(n$2 == 0), false); [line 119, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_22" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_19" ;
"test_switch6.a23e54b3840073f4ece330ef3c560915_22" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_20" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_23" [label="23: DeclStmt \n VARIABLE_DECLARED(value:int); [line 117, column 3]\n *&value:int=0 [line 117, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch6.a23e54b3840073f4ece330ef3c560915_23" -> "test_switch6.a23e54b3840073f4ece330ef3c560915_5" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_1" [label="1: Start test_switch7\nFormals: \nLocals: z:int something:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_1" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_17" ;
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_2" [label="2: Exit test_switch7 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" [label="3: Return Stmt \n *&return:int=0 [line 151, column 3]\n APPLY_ABSTRACTION; [line 151, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_2" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_4" [label="4: SwitchStmt \n n$0=_fun_getValue() [line 138, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_4" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_15" ;
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_4" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_16" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_5" [label="5: DeclStmt \n VARIABLE_DECLARED(z:int); [line 146, column 7]\n *&z:int=9 [line 146, column 7]\n APPLY_ABSTRACTION; [line 146, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_5" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_6" [label="6: UnaryOperator \n n$3=*&something:int [line 144, column 7]\n *&something:int=(n$3 + 1) [line 144, column 7]\n NULLIFY(&something); [line 144, column 7]\n EXIT_SCOPE(n$3,something); [line 144, column 7]\n APPLY_ABSTRACTION; [line 144, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_6" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_7" [label="7: DeclStmt \n VARIABLE_DECLARED(something:int); [line 143, column 7]\n *&something:int=1 [line 143, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_7" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_6" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_8" [label="8: Call _fun_printf \n n$5=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 140, column 7]\n EXIT_SCOPE(n$5); [line 140, column 7]\n APPLY_ABSTRACTION; [line 140, column 7]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_8" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_9" [label="9: Prune (true branch, switch) \n PRUNE((n$0 == 3), true); [line 148, column 5]\n EXIT_SCOPE(n$0); [line 148, column 5]\n APPLY_ABSTRACTION; [line 148, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_9" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_10" [label="10: Prune (false branch, switch) \n PRUNE(!(n$0 == 3), false); [line 148, column 5]\n EXIT_SCOPE(n$0); [line 148, column 5]\n APPLY_ABSTRACTION; [line 148, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_10" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_11" [label="11: Prune (true branch, switch) \n PRUNE((n$0 == 2), true); [line 147, column 5]\n EXIT_SCOPE(n$0); [line 147, column 5]\n APPLY_ABSTRACTION; [line 147, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_11" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_3" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_12" [label="12: Prune (false branch, switch) \n PRUNE(!(n$0 == 2), false); [line 147, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_12" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_9" ;
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_12" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_10" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_13" [label="13: Prune (true branch, switch) \n PRUNE((n$0 == 1), true); [line 142, column 5]\n EXIT_SCOPE(n$0); [line 142, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_13" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_7" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_14" [label="14: Prune (false branch, switch) \n PRUNE(!(n$0 == 1), false); [line 142, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_14" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_11" ;
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_14" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_12" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_15" [label="15: Prune (true branch, switch) \n PRUNE((n$0 == 0), true); [line 139, column 5]\n EXIT_SCOPE(n$0); [line 139, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_15" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_8" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_16" [label="16: Prune (false branch, switch) \n PRUNE(!(n$0 == 0), false); [line 139, column 5]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_16" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_13" ;
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_16" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_14" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_17" [label="17: DeclStmt \n VARIABLE_DECLARED(value:int); [line 137, column 3]\n *&value:int=0 [line 137, column 3]\n NULLIFY(&value); [line 137, column 3]\n EXIT_SCOPE(value); [line 137, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch7.8298274f5578f21bdddf71ffa79afcb8_17" -> "test_switch7.8298274f5578f21bdddf71ffa79afcb8_4" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_1" [label="1: Start test_switch8\nFormals: \nLocals: a:int 0$?%__sil_tmpSIL_temp_conditional___n$1:int z:int something:int value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_1" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_29" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_2" [label="2: Exit test_switch8 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_3" [label="3: Return Stmt \n *&return:int=0 [line 173, column 3]\n APPLY_ABSTRACTION; [line 173, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_3" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_2" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_4" [label="4: + \n " ]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_4" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_5" ;
Change license to MIT Summary: Change the license of the source code from BSD + PATENTS to MIT. Change `checkCopyright` to reflect the new license and learn some new file types. Generated with: ``` git grep BSD | xargs -n 1 ./scripts/checkCopyright -i ``` Reviewed By: jeremydubreil, mbouaziz, jberdine Differential Revision: D8071249 fbshipit-source-id: 97ca23a
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_5" [label="5: BinaryOperatorStmt: LT \n n$0=*&value:int [line 156, column 10]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_5" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_6" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_5" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_7" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_6" [label="6: Prune (true branch, while) \n PRUNE((n$0 < 10), true); [line 156, column 10]\n EXIT_SCOPE(n$0); [line 156, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_6" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_10" ;
[SIL][preanalysis] add call flag for functions treating first formal as return Summary: This helps some checkers and the liveness preanalysis. Reviewed By: da319 Differential Revision: D13102954 fbshipit-source-id: b8d3c5fe2
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_7" [label="7: Prune (false branch, while) \n PRUNE(!(n$0 < 10), false); [line 156, column 10]\n NULLIFY(&value); [line 156, column 10]\n EXIT_SCOPE(n$0,value); [line 156, column 10]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_7" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" [label="8: DeclStmt \n VARIABLE_DECLARED(a:int); [line 171, column 5]\n *&a:int=0 [line 171, column 5]\n NULLIFY(&a); [line 171, column 5]\n EXIT_SCOPE(a); [line 171, column 5]\n APPLY_ABSTRACTION; [line 171, column 5]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_4" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_9" [label="9: + \n " ]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_9" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_15" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_10" [label="10: BinaryOperatorStmt: EQ \n n$2=_fun_getValue() [line 157, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_10" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_11" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_10" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_12" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_11" [label="11: Prune (true branch, boolean exp) \n PRUNE((n$2 == 0), true); [line 157, column 13]\n EXIT_SCOPE(n$2); [line 157, column 13]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_11" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_13" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_12" [label="12: Prune (false branch, boolean exp) \n PRUNE(!(n$2 == 0), false); [line 157, column 13]\n EXIT_SCOPE(n$2); [line 157, column 13]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_12" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_14" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_13" [label="13: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$1:int=1 [line 157, column 13]\n APPLY_ABSTRACTION; [line 157, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_13" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_9" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_14" [label="14: ConditionalStmt Branch \n *&0$?%__sil_tmpSIL_temp_conditional___n$1:int=2 [line 157, column 13]\n APPLY_ABSTRACTION; [line 157, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_14" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_9" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_15" [label="15: SwitchStmt \n n$3=*&0$?%__sil_tmpSIL_temp_conditional___n$1:int [line 157, column 13]\n NULLIFY(&0$?%__sil_tmpSIL_temp_conditional___n$1); [line 157, column 13]\n EXIT_SCOPE(0$?%__sil_tmpSIL_temp_conditional___n$1); [line 157, column 13]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_15" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_27" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_15" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_28" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_16" [label="16: DeclStmt \n VARIABLE_DECLARED(z:int); [line 166, column 9]\n *&z:int=9 [line 166, column 9]\n APPLY_ABSTRACTION; [line 166, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_16" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_17" [label="17: UnaryOperator \n n$7=*&something:int [line 163, column 9]\n *&something:int=(n$7 + 1) [line 163, column 9]\n NULLIFY(&something); [line 163, column 9]\n EXIT_SCOPE(n$7,something); [line 163, column 9]\n APPLY_ABSTRACTION; [line 163, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_17" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_4" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_18" [label="18: DeclStmt \n VARIABLE_DECLARED(something:int); [line 162, column 9]\n *&something:int=1 [line 162, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_18" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_17" ;
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_19" [label="19: Return Stmt \n *&return:int=0 [line 160, column 9]\n APPLY_ABSTRACTION; [line 160, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_19" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_2" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_20" [label="20: Call _fun_printf \n n$8=_fun_printf((char const *)\"(0)HELLO WORLD!\":char const *) [line 159, column 9]\n EXIT_SCOPE(n$8); [line 159, column 9]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_20" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_19" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_21" [label="21: Prune (true branch, switch) \n PRUNE((n$3 == 3), true); [line 168, column 7]\n EXIT_SCOPE(n$3); [line 168, column 7]\n APPLY_ABSTRACTION; [line 168, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_21" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_22" [label="22: Prune (false branch, switch) \n PRUNE(!(n$3 == 3), false); [line 168, column 7]\n EXIT_SCOPE(n$3); [line 168, column 7]\n APPLY_ABSTRACTION; [line 168, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_22" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_23" [label="23: Prune (true branch, switch) \n PRUNE((n$3 == 2), true); [line 167, column 7]\n EXIT_SCOPE(n$3); [line 167, column 7]\n APPLY_ABSTRACTION; [line 167, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_23" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_8" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_24" [label="24: Prune (false branch, switch) \n PRUNE(!(n$3 == 2), false); [line 167, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_24" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_21" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_24" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_22" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_25" [label="25: Prune (true branch, switch) \n PRUNE((n$3 == 1), true); [line 161, column 7]\n EXIT_SCOPE(n$3); [line 161, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_25" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_18" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_26" [label="26: Prune (false branch, switch) \n PRUNE(!(n$3 == 1), false); [line 161, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_26" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_23" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_26" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_24" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_27" [label="27: Prune (true branch, switch) \n PRUNE((n$3 == 0), true); [line 158, column 7]\n NULLIFY(&value); [line 158, column 7]\n EXIT_SCOPE(n$3,value); [line 158, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_27" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_20" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_28" [label="28: Prune (false branch, switch) \n PRUNE(!(n$3 == 0), false); [line 158, column 7]\n " shape="invhouse"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_28" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_25" ;
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_28" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_26" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_29" [label="29: DeclStmt \n VARIABLE_DECLARED(value:int); [line 155, column 3]\n *&value:int=0 [line 155, column 3]\n APPLY_ABSTRACTION; [line 155, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_29" -> "test_switch8.6a6653773b94c1bb3f3c90dc1790d1ed_4" ;
Get rid of Declare_locals Reviewed By: jeremydubreil Differential Revision: D9234331 fbshipit-source-id: 70443eabe
6 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_1" [label="1: Start test_switch9\nFormals: \nLocals: value:int \n " color=yellow style=filled]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_1" -> "test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_5" ;
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_2" [label="2: Exit test_switch9 \n " color=yellow style=filled]
initial synchronization
10 years ago
[cfg] print dotty *after* pre-analysis Summary: Useful to understand the changes in the pre-analysis, or to inspect the CFG that checkers actually get. This means that the pre-analysis always runs when we output the dotty, but I don't really see a reason why not. In fact, we could probably *always* store the CFGs as pre-analysed. Reviewed By: mbouaziz Differential Revision: D13102952 fbshipit-source-id: 89f3102ec
6 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_3" [label="3: Return Stmt \n *&return:int=0 [line 179, column 3]\n APPLY_ABSTRACTION; [line 179, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_3" -> "test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_2" ;
[preanalysis] do not delay killing variables taken by reference Summary: Before, the liveness pre-analysis would place extra instructions in the CFG for either: 1. marking an `Ident.t` as dead, or 2. marking a `Pvar.t` as `= 0` But we have no way of marking pvars dead without setting them to 0. This is bad because setting pvars to 0 is not possible everywhere they are dead. Indeed, we only do it when we haven't seen their address being taken anyway. This prevents the following situation, recorded in our tests: ``` int address_taken() { int** x; int* y; int i = 7; y = &i; x = &y; // if we don't reason about taken addresses while adding nullify instructions, // we'll add // `nullify(y)` here and report a false NPE on the next line return **x; } ``` So we want to mark pvars as dead without nullifying them. This diff extends the `Remove_temps` SIL instruction to accept pvars as well, and so renames it to `ExitScope`. Reviewed By: da319 Differential Revision: D13102953 fbshipit-source-id: aa7f03a52
6 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_4" [label="4: SwitchStmt \n n$0=*&value:int [line 178, column 11]\n NULLIFY(&value); [line 178, column 11]\n EXIT_SCOPE(n$0,value); [line 178, column 11]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_4" -> "test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_3" ;
[SIL] change `variable_initialization()` builtin to a new auxiliary instruction Summary: Instead of emitting an ad-hoc builtin on variable declaration emit a new metadata instruction. This allows us to remove the code matching on that ad-hoc builtin that had to be inserted in several checkers. Inferbo & pulse used that information meaningfully and had to undergo some minor changes to cope with the new metada instruction. Reviewed By: ezgicicek Differential Revision: D14833100 fbshipit-source-id: 9b3009d22
6 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_5" [label="5: DeclStmt \n VARIABLE_DECLARED(value:int); [line 177, column 3]\n *&value:int=0 [line 177, column 3]\n " shape="box"]
initial synchronization
10 years ago
[clang] make switch statement translation more robust Summary: Labels inside switch statements were causing havoc (see test), and the translation of switch statements in general could be improved to handle more cases. It turns out that `case` (and `default`) statements are more or less fancy labels into the code. In other words, if you erase all the `case XXX:` and `default:` strings in the `switch` statement you get the real structure of the program, and `switch` just jumps straight to the first `case` directives (and to the second if the first one is not satisfied, etc. until all `case`/`default` have been considered). This suggests an alternative implementation: translate the body of the `switch` and simply record the list of switch cases inside that body, along with where they point to. Then post-process this list to construct the control flow of the `switch`, which points into the control-flow of the `body`. In order not to modify every function in `CTrans` to propagate the current list of cases, I created an ugly `ref` inside `SwitchCase` instead (but it cannot be directly accessed and it's guaranteed to be well-parenthesised wrt nested switches by the `SwitchCase` API so it's not too bad). [unrelated] Also make translation failures output more information about what exactly in the source code is causing the crash, and the ancestors in the AST that lead to the crash site. Reviewed By: martinoluca Differential Revision: D8011046 fbshipit-source-id: 8455090
7 years ago
"test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_5" -> "test_switch9.f4a96f02ca05cf92a483f69cdfe717b1_4" ;
initial synchronization
10 years ago
}