<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(79, 129, 135);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #000000" class=""><br class=""></span></div><div><blockquote type="cite" class=""><div class="">On Oct 19, 2015, at 5:39 AM, scott constable via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Matthias,<div class=""><br class=""></div><div class="">I can at least give you a partial solution. The reason that checkDeadSymbols() is not triggered by 'i' going out of scope is that 'i' is not symbolic. Symbols refer to values which the analyzer cannot properly model, other than by assigning constraints to them. Since 'i' is declared locally, and a reference to 'i' never leaves this translation unit, 'i' is never assigned a symbolic value. I think that what you need is provided by the analysis context. You can do something like:</div><div class=""><br class=""></div><div class="">const CFGBlock *currentBlock = Ctx.getLocationContext()->getCurrentStackFrame()->getCallSiteBlock();</div><div class="">LiveVariables *analysisLV = Ctx.getLocationContext()->getAnalysis<RelaxedLiveVariables>();</div><div class="">if (!analysisLV->isLive(currentBlock, iVar)) {</div><div class=""> // iVar went out of scope, handle it somehow</div><div class="">}</div></div></div></blockquote><div><br class=""></div><div>Unfortunately, I don’t think the live variables analysis will quite do what is needed because it determines whether the value stored in the variable may be later read — it doesn’t say when the underlying storage for the variable will disappear.</div><div><br class=""></div><div>For example:</div><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><div style="margin: 0px; line-height: normal;" class=""> <span style="font-variant-ligatures: no-common-ligatures; color: #bb2ca2" class="">int</span> p = <span style="font-variant-ligatures: no-common-ligatures; color: #272ad8" class="">5</span>;</div><div style="margin: 0px; line-height: normal;" class=""> p = <span style="font-variant-ligatures: no-common-ligatures; color: #272ad8" class="">6</span>;</div><div style="margin: 0px; line-height: normal; min-height: 13px;" class=""> // Live variables says p is dead here.</div><div style="margin: 0px; line-height: normal;" class=""> p = <span style="font-variant-ligatures: no-common-ligatures; color: #272ad8" class="">7</span>;</div><div style="margin: 0px; line-height: normal;" class=""> // Live variables says p is alive here.</div><div style="margin: 0px; line-height: normal; color: rgb(209, 47, 27);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #000000" class=""> </span><span style="font-variant-ligatures: no-common-ligatures; color: #3d1d81" class="">printf</span><span style="font-variant-ligatures: no-common-ligatures; color: #000000" class="">(</span>"p is %d\n"<span style="font-variant-ligatures: no-common-ligatures; color: #000000" class="">, p);</span></div></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><br class=""></div></div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">The next question would be concern which callback to hook. Although checkEndFunction() would be the easiest, it's not precise enough to handle compoundStmts. But I'm not aware of a better option (someone else might be?).</div></div></div></blockquote><div><br class=""></div><div>We don’t have a hook to tell checkers when a variable has gone out of scope, although it probably wouldn’t be that difficult to add. With this callback, you could iterate over the bindings in the heap to determine when there is a reference to out-of-scope storage. We currently do something similar in <span style="color: rgb(79, 129, 135); font-family: Menlo; font-size: 11px;" class="">StackAddrEscapeChecker</span><span style="font-family: Menlo; font-size: 11px;" class="">::checkEndFunction()</span> to issue a diagnostic when the address of a local variable is stored in a global (<span style="color: rgb(79, 129, 135); font-family: Menlo; font-size: 11px;" class="">StackAddrEscapeChecker</span> could probably also be extended to handle storing local addresses in the heap).</div><div><br class=""></div><div>Devin</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">~Scott</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Sun, Oct 18, 2015 at 6:39 PM, Matthias Gehre via cfe-dev <span dir="ltr" class=""><<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" class="">cfe-dev@lists.llvm.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div style="font-size:12.8px" class="">Hi,</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">I'm currently trying to implement a clang analyzer check</div><div style="font-size:12.8px" class="">to detect dangling pointers to a local (that went out of scope), like in:</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class=""><div class="">void pointer_leaves_scope(bool bb) {<br class=""></div><div class=""> int* p;</div><div class=""> {<br class=""></div><div class=""> int i = 0;</div><div class=""> p = &i;</div><div class=""> } // need to get a callback here</div><div class=""> *p = 1; // should produce warning: i went out-of-scope</div><div class="">}</div></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">I first though that <span style="font-size:12.8px" class="">checkDeadSymbols(..)</span><span style="font-size:12.8px" class=""> will be called when i goes out of scope,</span></div><div style="font-size:12.8px" class=""><span style="font-size:12.8px" class="">but it does not. Seems that I don't understand what </span><span style="font-size:12.8px" class="">checkDeadSymbols is supposed to do.</span></div><div style="font-size:12.8px" class=""><span style="font-size:12.8px" class=""><br class=""></span></div><div style="font-size:12.8px" class=""><span style="font-size:12.8px" class="">I </span><span style="font-size:12.8px" class="">also</span><span style="font-size:12.8px" class=""> </span><span style="font-size:12.8px" class="">tried checkPostStmt(</span><span style="font-size:12.8px" class="">CompoundStmt*,..), </span><span style="font-size:12.8px" class="">but that is not called either.</span></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Now I'm looking how to implement this callback (could be named <span style="font-size:12.8px" class="">checkSymbolLeavesScope).</span></div><div style="font-size:12.8px" class=""><span style="font-size:12.8px" class="">Or something like </span><span style="font-size:12.8px" class="">checkEndFunction() </span><span style="font-size:12.8px" class="">but for all local scopes.</span></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Could anyone please give me some hints where to add this to the analyzer core?</div><div style="font-size:12.8px" class="">I'm I missing something obvious?</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Thanks,</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Matthias</div></div>
<br class="">_______________________________________________<br class="">
cfe-dev mailing list<br class="">
<a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a><br class="">
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank" class="">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br class="">
<br class=""></blockquote></div><br class=""></div>
_______________________________________________<br class="">cfe-dev mailing list<br class=""><a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a><br class="">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev<br class=""></div></blockquote></div><br class=""></body></html>