<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hmm, this sounds like a very reasonable approach. Will see what i
can do, shouldn't be very hard. In fact, !isLive() should be enough
once all the liveness info is collected. Due to first-class
relations, amounts of live and dead symbols are typically infinite,
and this approach takes care of that. Still, by automating the old
approach by exploring the checker GDM we could achieve better
performance due to the short-path optimization below (but not due to
lookup direction in checkers, which is seemingly optimized through
dead_begin()..dead_end(), because we'd have to iterate through the
state in checkLiveSymbols phase anyway).<br>
<br>
<div class="moz-cite-prefix">On 31.03.2016 04:23, Anna Zaks wrote:<br>
</div>
<blockquote
cite="mid:960D2E92-F5D4-43ED-8993-330558E14E59@apple.com"
type="cite">Ted pointed out that isLive covers the symbols that do
not exist in the state. Have you tried addressing the issue with
something like this:<br class="">
<div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">diff --git
a/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h
b/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">index 30481ea..1c5a984 100644</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">---
a/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">+++
b/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(52, 187, 199);" class="">@@
-550,8 +550,8 @@ public:</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> ///</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> /// This should only be
called once all marking of dead symbols has completed.</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> /// (For checkers, this
means only in the evalDeadSymbols callback.)</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
bool isDead(SymbolRef sym) const {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
return TheDead.count(sym);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(52, 189, 38);" class="">+
bool isDead(SymbolRef sym) {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(52, 189, 38);" class="">+
return TheDead.count(sym) || !isLive(sym);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> }</div>
</div>
<div><br class="">
</div>
<div>Almost all tests pass with this change and the one that
does not looks like a legitimate new leak reported.</div>
<div><br class="">
</div>
<div>There are a couple of issues to further investigate here:</div>
<div>- What are the performance implications? I'd expect some,
but they are probably not very bad. Still we should measure.</div>
<div>- We should probably eliminate the use of dead_begin
dead_end, which some checkers reply on.</div>
<div>- removeDeadBindings is not run right after the last
reference to the object is lost, which leads to imprecise
error reports and failure to report the leak in some cases.
It's because of how hasDeadSymbols() is implemented. That
problem is solved if we disable the optimization, but I do not
know how that effects performance. Maybe we can come up with
something more clever.</div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">diff --git
a/lib/StaticAnalyzer/Core/ExprEngine.cpp
b/lib/StaticAnalyzer/Core/ExprEngine.cpp</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">index 0b66933..e43c5b7 100644</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">---
a/lib/StaticAnalyzer/Core/ExprEngine.cpp</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">+++
b/lib/StaticAnalyzer/Core/ExprEngine.cpp</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class="">@@ -380,14 +380,7 @@ void
ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet
&Out,</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> // Process any special
transfer function for dead symbols.</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> // A tag to track
convenience transitions, which can be removed at cleanup.</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo;" class=""> static
SimpleProgramPointTag cleanupTag(TagProviderName, "Clean
Node");</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">- if
(!SymReaper.hasDeadSymbols()) {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
// Generate a CleanedNode that has the environment and store
cleaned</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
// up. Since no symbols are dead, we can optimize and not
clean out</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
// the constraint manager.</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-
Bldr.generateNode(DiagnosticStmt, Pred, CleanedState,
&cleanupTag, K);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">-</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(195, 55, 32);" class="">- }
else {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Menlo; color: rgb(52, 189, 38);" class="">+ {</div>
</div>
<div class=""><br class="">
</div>
<div class="">Artem, let me know if you'd like to finish the
work on this; otherwise either me or Devin could conduct the
remaining investigations.</div>
<div class=""><br class="">
</div>
<div class="">Cheers,</div>
<div class="">Anna.</div>
<br>
</div>
</blockquote>
<br>
</body>
</html>