<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>Hi Anna,<br></div>
<div> </div>
<blockquote><div>The last line is probably wrong.. You have "checkPostStmt on v.begin()" twice.<br></div>
</blockquote><div> </div>
<div>I get it every time I re-run the checker, so I'm positive this is what happens. It did look weird for me too, that's why I mentioned it. Note though that I'm using Clang 3.3, so it <i>might</i> be something that's been fixed since then.<br></div>
<div> </div>
<div>This is what I get for the bind:<br></div>
<div> </div>
<blockquote><div>Bind: val lazyCompoundVal{0x4cca6b0,temp_object{iterator,0x4bd1df0}} => loc &it<br></div>
<div> - in stmt: v.begin()<br></div>
<div> - stmt ast: CXXConstructExpr 0x4bd5d18 'std::vector<int>::iterator':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' 'void (class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > > &&) noexcept' elidable<br></div>
<div>`-MaterializeTemporaryExpr 0x4bd5bb8 'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' xvalue<br></div>
<div> `-CXXMemberCallExpr 0x4bd1df0 'iterator':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >'<br></div>
<div> `-MemberExpr 0x4bd1dc0 '<bound member function type>' .begin 0x4bc7600<br></div>
<div> `-DeclRefExpr 0x4bd1d28 'std::vector<int>':'class std::vector<int, class std::allocator<int> >' lvalue Var 0x4b96ee0 'v' 'std::vector<int>':'class std::vector<int, class std::allocator<int> >'<br></div>
</blockquote><div> </div>
<blockquote><div id="sig19426269"><div class="signature">The issue here is that the iterators are value objects, represented by
LazyCompoundVals and SVals, and we do not have any way of
persisting/tracking values right now.<br></div>
</div>
</blockquote><div id="sig19426269"><div class="signature"> </div>
<div class="signature">The only case I'm concerning myself with right now is when iterators are saved into local variables, like so:<br></div>
<div class="signature"> </div>
</div>
<blockquote><div id="sig19426269"><div class="signature">std::vector<int> v = { 1, 2, 3 };<br></div>
<div class="signature">auto it = v.begin();<br></div>
<div class="signature">v.push_back(10);<br></div>
<div class="signature">it++; // possibly invalid!<br></div>
</div>
</blockquote><div id="sig19426269"><div class="signature"> </div>
<div class="signature">The variable 'it' will be represented by a memory region, and that it what I'm tracking, instead of the actual iterator value. I realize that this is limiting, but my understanding of the Clang Static Analyzer is rather limited and this is the best I could come up with. :)<br></div>
<div class="signature"> </div>
<div class="signature">Basically the only problem seems to be that I don't get consistent values representing the iterator: the result SVal from checkPostCall is different than the value that is actually bound to the variable. I guess I can try to work-around by implementing a kind of a state machine, and instead of starting to track iterator values in checkPostCall, I just record that a given Expr yields an iterator value, and look for that Expr in checkBind, but that sounds hackish and I don't see any reason why what I'm trying now shouldn't work.<br></div>
<div class="signature"> </div>
<div class="signature">Thanks!<br></div>
<div class="signature"> </div>
<div class="signature">-- <br></div>
<div class="signature"> Gábor Kozár -- ShdNx<br></div>
<div class="signature"> kozargabor@gmail.com<br></div>
<div class="signature"> </div>
<br></div>
<div> </div>
<div>On Thu, Sep 12, 2013, at 19:48, Anna Zaks wrote:<br></div>
<blockquote type="cite"><div> </div>
<div><div>On Sep 11, 2013, at 2:03 PM, Gábor Kozár <<a href="mailto:kozargabor@gmail.com">kozargabor@gmail.com</a>> wrote:<br></div>
<div> </div>
<blockquote type="cite"><div><div>I'm analyzing the following source line:<br></div>
<div> </div>
<div>auto it = v.begin(); // v is an std::vector<int><br></div>
<div> </div>
<div>As far as I'm able to reconstruct what happens using the checker callbacks, it goes somehow like this:<br></div>
<div> - checkPostCall on v.begin(): the call has been interpreted, the result is a lazyCompoundVal with a temp_object within it<br></div>
<div> - checkPostStmt on v.begin(): ProgramState::getSVal() yields the same result as above (the same lazyCompoundVal with the same temp_object within it)<br></div>
<div> - bind: some lazyCompoundVal with a temp_object within it to loc '&it' -- but this lazyCompoundVal and temp_object are different than above!!!<br></div>
<div> - checkPostStmt on v.begin() again: ProgramState::getSVal() yields &it, getting the SVal inside the region gives a lazyCompoundVal with 'it' in it<br></div>
</div>
</blockquote><div> </div>
<div>The last line is probably wrong.. You have "checkPostStmt on v.begin()" twice. Also, can you figure out which AST node is responsible for the bind?<br></div>
<div> </div>
<div>Basically, to understand what is going on better, it would be valuable to match the AST of the statements to the callbacks (you can get the AST with <span style="font-family:Menlo" class="font"><span style="font-size:11px" class="size">clang -cc1 -ast-dump</span></span>):<br></div>
<div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-DeclStmt 0x1023e7f00 <line:6:3, col:22><br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-VarDecl 0x1023cd780 <col:3, col:21> it 'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >'<br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-CXXConstructExpr 0x1023e7ec8 <col:13, col:21> 'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' 'void (const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > > &) throw()' elidable<br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-MaterializeTemporaryExpr 0x1023e7da8 <col:13, col:21> 'const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' lvalue<br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-ImplicitCastExpr 0x1023e7d90 <col:13, col:21> 'const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' <NoOp><br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-CXXMemberCallExpr 0x1023cd8a0 <col:13, col:21> 'iterator':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >'<br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-MemberExpr 0x1023cd870 <col:13, col:15> '<bound member function type>' .begin 0x1023c66d0<br></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-DeclRefExpr 0x1023cd7d8 <col:13> 'std::vector<int>':'class std::vector<int, class std::allocator<int> >' lvalue Var 0x1023bebc0 'v' 'std::vector<int>':'class std::vector<int, class std::allocator<int> >'<br></div>
<div> </div>
</div>
<div> </div>
<div>We've looked at implementing these checks before and it is not a simple problem. The issue here is that the iterators are value objects, represented by LazyCompoundVals and SVals, and we do not have any way of persisting/tracking values right now.<br></div>
</div>
<div> </div>
<div>Let's start with mapping the results of callbacks to the AST nodes to see if the modeling that we have now makes sense. <br></div>
<div> </div>
<div>Thanks,<br></div>
<div>Anna.<br></div>
<div> </div>
<div><blockquote type="cite"><div><div> </div>
<div>My problem is that I'm unable to implement a checker that would need to track iterator values, as temp_objects just seem to pop and disappear without leaving a trace and without having any followable connection between them.<br></div>
<div> </div>
<div>Is this working as intended, and if so, how should I approach this? I recall there being an open project for better modelling of C++ temporary objects, is that whose effect I'm seeing here?<br></div>
<div> </div>
<div>Thanks!<br></div>
<div> </div>
<div><div>-- <br></div>
<div> Gábor Kozár -- ShdNx<br></div>
<div> <a href="mailto:kozargabor@gmail.com">kozargabor@gmail.com</a><br></div>
<div> </div>
</div>
</div>
<div>
_______________________________________________<br></div>
<div>cfe-dev mailing list<br></div>
<div><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br></div>
<div>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></div>
</blockquote></div>
<div> </div>
<div> </div>
</blockquote></body>
</html>