Fix array size for Java in `get_malloc_info`

Reviewed By: mbouaziz

Differential Revision: D9028059

fbshipit-source-id: a82664103

infer/src/bufferoverrun/bufferOverrunChecker.ml

@@ -283,11 +283,6 @@ module TransferFunctions (CFG : ProcCfg.S) = struct
                   declare_local ~decl_local model_env loc ~inst_num ~dimension mem
               | None ->
                   (mem, inst_num) )
-            (* Temporary fix for ArrayLists in Java, need a better
-                 way to handle local vars, see T31498711 *)
-            | Typ.Tptr (typ, _)
-              when Language.curr_language_is Java ->
-                decl_local pname ~node_hash location loc typ ~inst_num ~dimension mem
             | _ ->
                 (mem, inst_num)
           in

infer/src/bufferoverrun/bufferOverrunModels.ml

@@ -48,6 +48,10 @@ let get_malloc_info : Exp.t -> Typ.t * Int.t option * Exp.t * Exp.t option = fun
   | Exp.BinOp (Binop.Mult, Exp.Sizeof {typ; nbytes}, length)
   | Exp.BinOp (Binop.Mult, length, Exp.Sizeof {typ; nbytes}) ->
       (typ, nbytes, length, None)
+  (* In Java all arrays are dynamically allocated *)
+  | Exp.Sizeof {typ; nbytes; dynamic_length= Some arr_length}
+    when Language.curr_language_is Java ->
+      (typ, nbytes, arr_length, Some arr_length)
   | Exp.Sizeof {typ; nbytes; dynamic_length} ->
       (typ, nbytes, Exp.one, dynamic_length)
   | x ->

infer/tests/codetoanalyze/java/performance/Array.java

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2018-present, Facebook, Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+package codetoanalyze.java.performance;
+public class Array {
+
+  public void array_access_good() {
+    float[] radii = new float[8];
+    for (int i = 0; i < 4; ++i) {
+      radii[i * 2] = radii[i];
+      radii[i * 2 + 1] = radii[i] + 1;
+    }
+  }
+
+  public void array_access_overrun_bad() {
+    float[] radii = new float[8];
+    for (int i = 0; i < 4; ++i) {
+      radii[i * 2] = radii[i];
+      radii[i * 2 + 2] = radii[i] + 1;
+    }
+  }
+}

infer/tests/codetoanalyze/java/performance/issues.exp

@@ -1,3 +1,4 @@
+codetoanalyze/java/performance/Array.java, void Array.array_access_overrun_bad(), 4, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,Assignment,ArrayAccess: Offset: [2, 8] Size: [8, 8]]
 codetoanalyze/java/performance/ArrayCost.java, boolean ArrayCost.isPowOfTwo_FP(int), 4, EXPENSIVE_EXECUTION_TIME_CALL, no_bucket, ERROR, [with estimated cost 882, degree = 0]
 codetoanalyze/java/performance/ArrayCost.java, boolean ArrayCost.isPowOfTwo_FP(int), 4, EXPENSIVE_EXECUTION_TIME_CALL, no_bucket, ERROR, [with estimated cost 883, degree = 0]
 codetoanalyze/java/performance/ArrayCost.java, boolean ArrayCost.isPowOfTwo_FP(int), 5, EXPENSIVE_EXECUTION_TIME_CALL, no_bucket, ERROR, [with estimated cost 882, degree = 0]