<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 29, 2016, at 7:10 AM, Artem Dergachev via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">> You might want to store this in the repo by<br class="">> adding a document or extending this one:<br class="">> ./docs/analyzer/RegionStore.txt<br class=""><br class="">Hmm, i wish i could fix the bugs rather than document them (= Will have a look!<br class=""><br class=""></div></div></blockquote><div><br class=""></div>Ted pointed out that isLive covers the symbols that do not exist in the state. Have you tried addressing the issue with something like this:<br class=""><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h b/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">index 30481ea..1c5a984 100644</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">--- a/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(52, 187, 199);" class="">@@ -550,8 +550,8 @@<span style="font-variant-ligatures: no-common-ligatures; color: #000000" class=""> public:</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> ///</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> /// This should only be called once all marking of dead symbols has completed.</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> /// (For checkers, this means only in the evalDeadSymbols callback.)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- bool isDead(SymbolRef sym) const {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- return TheDead.count(sym);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(52, 189, 38);" class="">+ bool isDead(SymbolRef sym) {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(52, 189, 38);" class="">+ return TheDead.count(sym) || !isLive(sym);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> }</div></div><div><br class=""></div><div>Almost all tests pass with this change and the one that does not looks like a legitimate new leak reported.</div><div><br class=""></div><div>There are a couple of issues to further investigate here:</div><div>- What are the performance implications? I'd expect some, but they are probably not very bad. Still we should measure.</div><div>- We should probably eliminate the use of dead_begin dead_end, which some checkers reply on.</div><div>- removeDeadBindings is not run right after the last reference to the object is lost, which leads to imprecise error reports and failure to report the leak in some cases. It's because of how hasDeadSymbols() is implemented. That problem is solved if we disable the optimization, but I do not know how that effects performance. Maybe we can come up with something more clever.</div><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">diff --git a/lib/StaticAnalyzer/Core/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">index 0b66933..e43c5b7 100644</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">--- a/lib/StaticAnalyzer/Core/ExprEngine.cpp</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><b class="">+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #34bbc7" class="">@@ -380,14 +380,7 @@</span> void ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out,</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> // Process any special transfer function for dead symbols.</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> // A tag to track convenience transitions, which can be removed at cleanup.</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;" class=""> static SimpleProgramPointTag cleanupTag(TagProviderName, "Clean Node");</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- if (!SymReaper.hasDeadSymbols()) {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- // Generate a CleanedNode that has the environment and store cleaned</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- // up. Since no symbols are dead, we can optimize and not clean out</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- // the constraint manager.</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">-</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(195, 55, 32);" class="">- } else {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(52, 189, 38);" class="">+ {</div></div><div class=""><br class=""></div><div class="">Artem, let me know if you'd like to finish the work on this; otherwise either me or Devin could conduct the remaining investigations.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">Anna.</div><div class=""><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">> Taint has never been fully implemented. I also<br class="">> want to investigate using flow-sensitive analysis<br class="">> for taint tracking instead of the approach the<br class="">> current half-implementation uses.<br class=""><br class="">The current approach seems very sensible to me, i like it, and i'm not quite aware of any significant theoretical problems.<br class=""><br class="">The implementation gore of sharing the state trait across checkers is annoying, but since we want to eventually share all traits in a generic manner anyway, this problem would eventually be gone. It is also a bit hard to work with tainted strings, but that seems to be an SVal hierarchy thing rather than a taint implementation problem.<br class=""><br class="">Taint analysis becomes the most effective with heavy IPA, probably better even with inter-unit analysis and good call graph sorting to ensure top-bottom analysis, implying huge node limits, because input-output and usage are often spread out very far away from each other, through many function calls. It wouldn't find many things if it only considers small scopes.<br class="">_______________________________________________<br class="">cfe-dev mailing list<br class=""><a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a><br class="">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev<br class=""></div></div></blockquote></div><br class=""></body></html>