[pulse] Filter AddressOfStackVariable from read only heuristic check

Reviewed By: skcho

Differential Revision: D16518259

fbshipit-source-id: 92a631a82

infer/src/istd/PrettyPrintable.ml

@@ -223,6 +223,8 @@ module type PPUniqRankSet = sig
 
   val is_empty : t -> bool
 
+  val is_singleton : t -> bool
+
   val is_subset : t -> of_:t -> bool
 
   val map : t -> f:(elt -> elt) -> t
@@ -253,6 +255,8 @@ module MakePPUniqRankSet (Val : PrintableRankedType) : PPUniqRankSet with type e
 
   let is_empty = Map.is_empty
 
+  let is_singleton m = Int.equal 1 (Map.cardinal m)
+
   let is_subset m ~of_ =
     Map.for_all
       (fun rank value ->

infer/src/istd/PrettyPrintable.mli

@@ -174,6 +174,8 @@ module type PPUniqRankSet = sig
 
   val is_empty : t -> bool
 
+  val is_singleton : t -> bool
+
   val is_subset : t -> of_:t -> bool
 
   val map : t -> f:(elt -> elt) -> t

infer/src/pulse/PulseAbductiveDomain.ml

@@ -473,7 +473,8 @@ module PrePost = struct
     | None ->
         false
     | Some (edges_pre, _) ->
-        Attributes.is_empty attrs_post
+        ( Attributes.is_empty attrs_post
+        || Attributes.only_contains_address_of_stack_variable attrs_post )
         && PulseDomain.Memory.Edges.equal
              (fun (addr_dest_pre, _) (addr_dest_post, _) ->
                (* NOTE: ignores traces

infer/src/pulse/PulseDomain.ml

@@ -330,6 +330,11 @@ module Attributes = struct
     Set.find_rank attrs Attribute.std_vector_reserve_rank |> Option.is_some
 
 
+  let only_contains_address_of_stack_variable attrs =
+    Set.is_singleton attrs
+    && Option.is_some (Set.find_rank attrs Attribute.address_of_stack_variable_rank)
+
+
   include Set
 end
 

infer/src/pulse/PulseDomain.mli

@@ -96,6 +96,8 @@ module Attributes : sig
   val get_must_be_valid : t -> unit InterprocAction.t option
 
   val get_address_of_stack_variable : t -> (Var.t * ValueHistory.t * Location.t) option
+
+  val only_contains_address_of_stack_variable : t -> bool
 end
 
 module AbstractAddress : sig

infer/tests/codetoanalyze/cpp/pulse/issues.exp

@@ -1,4 +1,4 @@
-codetoanalyze/cpp/pulse/basic_string.cpp, use_range_of_invalidated_temporary_string_bad, 2, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,returned from call to `Range::Range()`,when calling `setLanguage()` here,when calling `std::basic_string::~basic_string()` (modelled) here,when calling `deleting the underlying string` (modelled) here,memory was invalidated by `delete` here,use-after-lifetime part of the trace starts here,variable declared,when calling `Range::operator[]()` here,invalid access occurs here]
+codetoanalyze/cpp/pulse/basic_string.cpp, use_range_of_invalidated_temporary_string_bad, 2, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,when calling `setLanguage()` here,when calling `std::basic_string::~basic_string()` (modelled) here,when calling `deleting the underlying string` (modelled) here,memory was invalidated by `delete` here,use-after-lifetime part of the trace starts here,variable declared,when calling `Range::operator[]()` here,invalid access occurs here]
 codetoanalyze/cpp/pulse/basics.cpp, multiple_invalidations_branch_bad, 6, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,memory was invalidated by `delete` here,use-after-lifetime part of the trace starts here,invalid access occurs here]
 codetoanalyze/cpp/pulse/basics.cpp, multiple_invalidations_loop_bad, 3, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,memory was invalidated by `delete` here,use-after-lifetime part of the trace starts here,invalid access occurs here]
 codetoanalyze/cpp/pulse/closures.cpp, call_lambda_bad, 4, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,assigned,memory was invalidated by `delete` here,use-after-lifetime part of the trace starts here,assigned,when calling `call_lambda_bad::lambda_closures.cpp:163:12::operator()()` here,invalid access occurs here]