pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '9dbbd68472'
${ noResults }
infer_clone/infer/tests/codetoanalyze/cpp/pulse/join.cpp

351 lines
6.8 KiB
Raw Normal View History Unescape

[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
/*
* Copyright (c) 2018-present, Facebook, Inc.
*
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*/
[pulse] add non-passing tests about join Summary: So we can see improvements in later diffs. Reviewed By: skcho Differential Revision: D13102949 fbshipit-source-id: 45494904b
6 years ago
#include <stdlib.h>
#include <vector>
[ai][pulse] use subgraph-based implication between states Summary: When joining two lists of disjuncts we try to ensure there isn't a state that under-approximates another already in the list. This helps reduce the number of disjuncts that are generated by conditionals and loops. Before we would always just add more disjuncts unless they were physically equal but now we do a subgraph computation to assess under-approximation. We only do this half-heartedly for now however, only taking into consideration the "new" disjuncts vs the "old" ones. It probably makes sense to do a full quadratic search to minimise the number of disjuncts from time to time but this isn't done here. Reviewed By: mbouaziz Differential Revision: D14258482 fbshipit-source-id: c2dad4889
6 years ago
void basic_loop_count_ok(int n) {
for (int i = 0; i < n; i++) {
}
}
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
struct foo {
int* val;
};
struct list {
struct list* next;
struct foo* foo;
};
[pulse] forget about addresses that are invalid on only one side of a join Summary: Getting this right will be long and complex so for now the easiest is to underreport and only consider as invalid the addresses we know to be invalid on both sides of a join. In fact the condition for an address to be invalid after a join is more complex than this: it is invalid only if *all* the addresses in its equivalence class as discovered by the join are invalid. Reviewed By: skcho Differential Revision: D12823925 fbshipit-source-id: 2ca109356
6 years ago
int invalidate_node_alias_bad(struct list* head, int cond) {
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
int* result = 0;
struct list* x = head;
if (cond) {
result = x->next->foo->val;
delete result;
} else {
x = x->next;
struct list* y = x->next;
result = x->foo->val;
[pulse] forget about addresses that are invalid on only one side of a join Summary: Getting this right will be long and complex so for now the easiest is to underreport and only consider as invalid the addresses we know to be invalid on both sides of a join. In fact the condition for an address to be invalid after a join is more complex than this: it is invalid only if *all* the addresses in its equivalence class as discovered by the join are invalid. Reviewed By: skcho Differential Revision: D12823925 fbshipit-source-id: 2ca109356
6 years ago
delete result;
[pulse] join of memory graphs Summary: Instead of the non-sensical piecewise join we had until now write a proper one. Hopefully the comments explain what it does. Main one: ``` (* high-level idea: maintain some union-find data structure to identify locations in one heap with locations in the other heap. Build the initial join state as follows: - equate all locations that correspond to identical variables in both stacks, eg joining stacks {x=1} and {x=2} adds "1=2" to the unification. - add all addresses reachable from stack variables to the join state heap This gives us an abstract state that is the union of both abstract states, but more states can still be made equal. For instance, if 1 points to 3 in the first heap and 2 points to 4 in the second heap and we deduced "1 = 2" from the stacks already (as in the example just above) then we can deduce "3 = 4". Proceed in this fashion until no more equalities are discovered, and return the abstract state where a canonical representative has been chosen consistently for each equivalence class (this is what the union-find data structure gives us). *) ``` Reviewed By: mbouaziz Differential Revision: D10483978 fbshipit-source-id: f6ffd7528
6 years ago
}
return *result;
}
[pulse] record attributes inside memory cells instead of separately Summary: It turns out keeping attributes (such as invalidation facts) separate from the memory is a bad idea and leads to loss of precision and false positives, as seen in the new test (which previously generated a report). Allow me to illustrate on this example, which is a stylised version of the issue in the added test: previously we'd have: ``` state1 = { x = 1; invalids={} } state2 = { x = 2; invalids ={1} } join(state1, state2) = { x = {1, 2}; invalids={{1, 2}} } ``` So even though none of the states said that `x` pointed to an invalid location, the join state says it does because `1` and `2` have been glommed together. The fact `x=1` from `state1` and the fact "1 is invalid" from `state2` conspire together and `x` is now invalid even though it shouldn't. Instead, if we record attributes as part of the memory we get that `x` is still valid after the join: ``` state1 = { x = (1, {}) } state2 = { x = (2, {}) } join(state1, state2) = { x = ({1, 2}, {}) } ``` Reviewed By: mbouaziz Differential Revision: D12958130 fbshipit-source-id: 53dc81cc7
6 years ago
[SIL][preanalysis] add call flag for functions treating first formal as return Summary: This helps some checkers and the liveness preanalysis. Reviewed By: da319 Differential Revision: D13102954 fbshipit-source-id: b8d3c5fe2
6 years ago
void list_delete_ok(struct list** l) {
[pulse] add non-passing tests about join Summary: So we can see improvements in later diffs. Reviewed By: skcho Differential Revision: D13102949 fbshipit-source-id: 45494904b
6 years ago
auto head = *l;
*l = nullptr;
while (head) {
auto tmp = head;
head = head->next;
if (tmp->foo) {
free(tmp->foo);
tmp->foo = nullptr;
}
}
}
[pulse] record attributes inside memory cells instead of separately Summary: It turns out keeping attributes (such as invalidation facts) separate from the memory is a bad idea and leads to loss of precision and false positives, as seen in the new test (which previously generated a report). Allow me to illustrate on this example, which is a stylised version of the issue in the added test: previously we'd have: ``` state1 = { x = 1; invalids={} } state2 = { x = 2; invalids ={1} } join(state1, state2) = { x = {1, 2}; invalids={{1, 2}} } ``` So even though none of the states said that `x` pointed to an invalid location, the join state says it does because `1` and `2` have been glommed together. The fact `x=1` from `state1` and the fact "1 is invalid" from `state2` conspire together and `x` is now invalid even though it shouldn't. Instead, if we record attributes as part of the memory we get that `x` is still valid after the join: ``` state1 = { x = (1, {}) } state2 = { x = (2, {}) } join(state1, state2) = { x = ({1, 2}, {}) } ``` Reviewed By: mbouaziz Differential Revision: D12958130 fbshipit-source-id: 53dc81cc7
6 years ago
struct BasicStruct {
[pulse] add non-passing tests about join Summary: So we can see improvements in later diffs. Reviewed By: skcho Differential Revision: D13102949 fbshipit-source-id: 45494904b
6 years ago
void some_method() {}
BasicStruct();
~BasicStruct();
[pulse] record attributes inside memory cells instead of separately Summary: It turns out keeping attributes (such as invalidation facts) separate from the memory is a bad idea and leads to loss of precision and false positives, as seen in the new test (which previously generated a report). Allow me to illustrate on this example, which is a stylised version of the issue in the added test: previously we'd have: ``` state1 = { x = 1; invalids={} } state2 = { x = 2; invalids ={1} } join(state1, state2) = { x = {1, 2}; invalids={{1, 2}} } ``` So even though none of the states said that `x` pointed to an invalid location, the join state says it does because `1` and `2` have been glommed together. The fact `x=1` from `state1` and the fact "1 is invalid" from `state2` conspire together and `x` is now invalid even though it shouldn't. Instead, if we record attributes as part of the memory we get that `x` is still valid after the join: ``` state1 = { x = (1, {}) } state2 = { x = (2, {}) } join(state1, state2) = { x = ({1, 2}, {}) } ``` Reviewed By: mbouaziz Differential Revision: D12958130 fbshipit-source-id: 53dc81cc7
6 years ago
};
int nested_loops_ok() {
while (true) {
BasicStruct x;
for (;;) {
x.some_method();
}
}
}
[pulse] add non-passing tests about join Summary: So we can see improvements in later diffs. Reviewed By: skcho Differential Revision: D13102949 fbshipit-source-id: 45494904b
6 years ago
extern bool some_bool();
extern BasicStruct mk_basic_struct();
[SIL][preanalysis] add call flag for functions treating first formal as return Summary: This helps some checkers and the liveness preanalysis. Reviewed By: da319 Differential Revision: D13102954 fbshipit-source-id: b8d3c5fe2
6 years ago
void cond_inside_loop_ok() {
[pulse] add non-passing tests about join Summary: So we can see improvements in later diffs. Reviewed By: skcho Differential Revision: D13102949 fbshipit-source-id: 45494904b
6 years ago
while (true) {
BasicStruct x;
if (some_bool()) {
x = mk_basic_struct();
}
x.some_method();
}
}
void nested_loops3_ok(std::vector<BasicStruct>* c) {
for (auto& b : *c) {
(&b)->~BasicStruct();
}
}
[pulse] more efficient representation of attributes Summary: This ensures that each attribute type can only be present once per address. Makes ~80x time improvement on pathological cases such as Duff's device. This introduces a new kind of Set in `PrettyPrintable`. Reviewed By: mbouaziz Differential Revision: D14645091 fbshipit-source-id: c7f9b760c
6 years ago
void duff_switch_loop(char* to, char* from, unsigned int count) {
unsigned int rounds = (count + 127) / 128;
switch (count % 128) {
case 0:
do {
*to = *from++;
case 127:
*to = *from++;
case 126:
*to = *from++;
case 125:
*to = *from++;
case 124:
*to = *from++;
case 123:
*to = *from++;
case 122:
*to = *from++;
case 121:
*to = *from++;
case 120:
*to = *from++;
case 119:
*to = *from++;
case 118:
*to = *from++;
case 117:
*to = *from++;
case 116:
*to = *from++;
case 115:
*to = *from++;
case 114:
*to = *from++;
case 113:
*to = *from++;
case 112:
*to = *from++;
case 111:
*to = *from++;
case 110:
*to = *from++;
case 109:
*to = *from++;
case 108:
*to = *from++;
case 107:
*to = *from++;
case 106:
*to = *from++;
case 105:
*to = *from++;
case 104:
*to = *from++;
case 103:
*to = *from++;
case 102:
*to = *from++;
case 101:
*to = *from++;
case 100:
*to = *from++;
case 99:
*to = *from++;
case 98:
*to = *from++;
case 97:
*to = *from++;
case 96:
*to = *from++;
case 95:
*to = *from++;
case 94:
*to = *from++;
case 93:
*to = *from++;
case 92:
*to = *from++;
case 91:
*to = *from++;
case 90:
*to = *from++;
case 89:
*to = *from++;
case 88:
*to = *from++;
case 87:
*to = *from++;
case 86:
*to = *from++;
case 85:
*to = *from++;
case 84:
*to = *from++;
case 83:
*to = *from++;
case 82:
*to = *from++;
case 81:
*to = *from++;
case 80:
*to = *from++;
case 79:
*to = *from++;
case 78:
*to = *from++;
case 77:
*to = *from++;
case 76:
*to = *from++;
case 75:
*to = *from++;
case 74:
*to = *from++;
case 73:
*to = *from++;
case 72:
*to = *from++;
case 71:
*to = *from++;
case 70:
*to = *from++;
case 69:
*to = *from++;
case 68:
*to = *from++;
case 67:
*to = *from++;
case 66:
*to = *from++;
case 65:
*to = *from++;
case 64:
*to = *from++;
case 63:
*to = *from++;
case 62:
*to = *from++;
case 61:
*to = *from++;
case 60:
*to = *from++;
case 59:
*to = *from++;
case 58:
*to = *from++;
case 57:
*to = *from++;
case 56:
*to = *from++;
case 55:
*to = *from++;
case 54:
*to = *from++;
case 53:
*to = *from++;
case 52:
*to = *from++;
case 51:
*to = *from++;
case 50:
*to = *from++;
case 49:
*to = *from++;
case 48:
*to = *from++;
case 47:
*to = *from++;
case 46:
*to = *from++;
case 45:
*to = *from++;
case 44:
*to = *from++;
case 43:
*to = *from++;
case 42:
*to = *from++;
case 41:
*to = *from++;
case 40:
*to = *from++;
case 39:
*to = *from++;
case 38:
*to = *from++;
case 37:
*to = *from++;
case 36:
*to = *from++;
case 35:
*to = *from++;
case 34:
*to = *from++;
case 33:
*to = *from++;
case 32:
*to = *from++;
case 31:
*to = *from++;
case 30:
*to = *from++;
case 29:
*to = *from++;
case 28:
*to = *from++;
case 27:
*to = *from++;
case 26:
*to = *from++;
case 25:
*to = *from++;
case 24:
*to = *from++;
case 23:
*to = *from++;
case 22:
*to = *from++;
case 21:
*to = *from++;
case 20:
*to = *from++;
case 19:
*to = *from++;
case 18:
*to = *from++;
case 17:
*to = *from++;
case 16:
*to = *from++;
case 15:
*to = *from++;
case 14:
*to = *from++;
case 13:
*to = *from++;
case 12:
*to = *from++;
case 11:
*to = *from++;
case 10:
*to = *from++;
case 9:
*to = *from++;
case 8:
*to = *from++;
case 7:
*to = *from++;
case 6:
*to = *from++;
case 5:
*to = *from++;
case 4:
*to = *from++;
case 3:
*to = *from++;
case 2:
*to = *from++;
case 1:
*to = *from++;
} while (--rounds > 0);
}
}