<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hmm. It sounds as if we need to fix both things here, and both of
them are something that you already know how to solve:<br>
<br>
1. Be able to constant-fold "gs.sub" to "&gsubs",<br>
2. Be able to constant-fold "(&gsubs)->p" to "0x80008000".<br>
<br>
I guess the confusion arises because steps 1 and 2 are separated in
time; they are in fact two independent loads. They interact through
the Environment: we compute the sub-expression, put its value into
the Environment, then later when we need to perform the second load
we can retrieve the value from the Environment. Once we perform the
first load correctly, it becomes irrelevant that such load ever
happened; ExprEngine, like checkers, is stateless. The problem
becomes as easy as loading "gsubs.p" because the analyzer knows, in
path-sensitive manner, that the sub-expression "gs.sub" has
evaluated to "&gsubs"; that'd be already encoded in the
MemRegion structure.<br>
<br>
So i think we don't need to retroactively create anything. Instead,
we simply need to perform every step precisely. Which is anyway a
good thing because there's always code that never gets to the second
step.<br>
<br>
Sorry if the answer is not spot-on; i'm not sure i fully understood
the question.<br>
<br>
<div class="moz-cite-prefix">On 6/7/18 1:52 AM, Rafael·Stahl via
cfe-dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:de6031d6-cfba-34d4-9d0b-e839caba988a@tum.de">Hi,
<br>
<br>
continuing my effort to make the analyzer understand more
constants, I did take a look at the following case:
<br>
<br>
<br>
struct SubS {
<br>
int *p;
<br>
};
<br>
<br>
struct S {
<br>
struct SubS *sub;
<br>
};
<br>
<br>
struct SubS const gsubs = {
<br>
.p = 0x80008000
<br>
};
<br>
struct S const gs = {
<br>
.sub = &gsubs
<br>
};
<br>
<br>
int main() {
<br>
struct SubS subs = {
<br>
.p = 0x80008000
<br>
};
<br>
struct S s = {
<br>
.sub = &subs
<br>
};
<br>
<br>
*s.sub->p;
<br>
*gs.sub->p;
<br>
}
<br>
<br>
Here, the analyzer recognizes the dereference via s, but not gs.
This seems to be the case because region information will be
stored for subs, but not for gsubs.
<br>
<br>
I'm not sure how to solve this issue. Could we retroactively
create the region information whenever we encounter constants like
this? Or rather add something to the getBinding functions that
manually resolves this case? For the latter it seems like the
analyzer should already understand what is happening without many
additions, but it's unclear to me how it connects.
<br>
<br>
Best regards
<br>
Rafael
<br>
<br>
<br>
<!--'"--><br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
cfe-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a>
<a class="moz-txt-link-freetext" href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>