Thanks Jordan. That was useful information. I also found <b>"</b><span style="font-family:Arial,Helvetica,sans-serif;font-size:1em">A memory model for static analysis of C programs<b>" </b>by Ted also very useful.</span><div>
<br></div><div>I'm trying to implement IPA across TU for my internal project. The approach i'm using is i'm dumping .ast of all files using -emit-ast option. </div><div>In case a function body is not found while analyzing i load the corresponding ast file having function definition and use this FunctionDecl with the current in-lining approach.</div>
<div><br></div><div>For example in the above code myFree() is implemented in another file and i get the FunctionDecl by loading the ast and use this to inline. </div><div><br></div><div>In this case though unfortunately region for 'q' does not contain a binding with the symbolic value returned from malloc. </div>
<div><br></div><div>Am i doing something wrong here or missing out something?</div><div><br></div><div>Any inputs greatly appreciated.</div><div><br></div><div>Thanks</div><div><br></div><div><div class="gmail_quote">On Tue, Mar 12, 2013 at 10:09 PM, Jordan Rose <span dir="ltr"><<a href="mailto:jordan_rose@apple.com" target="_blank">jordan_rose@apple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, Karthik. The analyzer does certain deliberate passes to clean up dead symbols and dead bindings in the state, generally before processing each statement. The top-level function for this is ExprEngine::ExprEngine::removeDead, and most of the high-level implementation is in the SymbolReaper class in ProgramState.h. The basic algorithm is pretty simple, though:<br>
<br>
(1) Find out which expressions and variables are still live (LiveVariables). This is cached, per-function, context-insensitive information.<br>
(2) Ask checkers which symbols are known to be in use, though potentially not live (checkLiveSymbols).<br>
(3) Mark live any values associated with live expressions in the Environment. Remove all other bindings.<br>
(4) Mark live any values accessible via the live regions in the Store. Remove all other bindings.<br>
(5) Remove any constraints on dead symbols.<br>
(6) Report dead symbols to the checkers, so that they can stop tracking information dependent on those symbols (checkDeadSymbols).<br>
<br>
<br>
Your second question is easier: parameter-passing is modeled as a bind to the region for the parameter (a VarRegion whose associated declaration is a ParmVarDecl). So your myFree() example is essentially the same as this:<br>
<br>
char *q = (char *)malloc(sizeof(char);<br>
char *p = q;<br>
free(p);<br>
free(q); // warning<br>
<br>
This happens in the 'enterStackFrame' method on the StoreManager, which uses CallEvent::getInitialStackFrameContents to figure out the initial bindings. You are correct that both the region for 'q' and the region for 'p' will contain a binding with the symbolic value returned from 'malloc'.<br>
<br>
Does this help?<br>
Jordan<br>
<br>
P.S. For the record, this model of parameter passing will not be entirely correct once we model the destructors of C++ temporary regions; we will need to be more careful about non-POD objects being passed by value.<br>
<div><div class="h5"><br>
<br>
On Mar 11, 2013, at 1:09 , Karthik Bhat <<a href="mailto:blitz.opensource@gmail.com">blitz.opensource@gmail.com</a>> wrote:<br>
<br>
> Hi All,<br>
> I was going through Malloc checker in clang Static analyzer. I had a few doubts-<br>
><br>
> 1) How is a symbol marked as dead( How does clang static analyzer detect that a symbol is dead) ?<br>
> E.g.<br>
><br>
> char* myMalloc()<br>
> {<br>
> char* p = (char*) malloc(sizeof(char));<br>
> return p;<br>
> }<br>
><br>
> int main()<br>
> {<br>
> char* q = myMalloc();<br>
> return 0;<br>
> }<br>
><br>
> In the above example symbol assigned for p in myMalloc is alive till main(caller) exits right?<br>
><br>
><br>
> 2) In case of IPA how are symbol propagated form one function to another in case it is passed as a parameter.<br>
> E.g.<br>
><br>
> void myFree(char* p)<br>
> {<br>
> free(p);<br>
> }<br>
><br>
> int main()<br>
> {<br>
><br>
> char* q = (char*) malloc(sizeof(char));<br>
> myFree(q);<br>
> free(q);<br>
> }<br>
><br>
> In the above example is it true that the parameter p in myFree is assigned the same symbol as that of q being passed to the function? If yes could someone guide me were this assignment of symbol happens?<br>
><br>
><br>
> Thanks<br>
> Karthik<br>
><br>
><br>
</div></div>> _______________________________________________<br>
> cfe-dev mailing list<br>
> <a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>
> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
<br>
</blockquote></div><br></div>