<div dir="ltr"><div dir="ltr">Hi!<br><br>There are some notes from the CSA roundtable. The meeting was pretty long and we had a chance to get a glimpse into GCC's analyzer as well, thanks a lot to David for sharing all that info! The notes might be a bit spotty, feel free to add more info in replies or correct anything that I got wrong.<br><br>People introducing themselves<div>Question from the chat: Is analyzer for LLVM IR? No, for source code.</div><div>Discussing best way to invoke the analyzer using command line, scan-build, codechecker.</div><div>Should we adopt -fanalyze from gcc? It is good for compatibility but we might have different output so we are conflicted. Want to keep this option open.</div><div>David, GCC's analyzer's author is interested in implementing SARIF so we have a common output format across GCC and Clang.</div><div>Discussing what are the best way to get started with CSA development</div><div>Short status report on Deep's GSoC project</div><div>Can we use the static analyzer to transform source code? Technically, it can emit fixits, but we would not recommend doing it from the analyzer. For fixits you need to understand all execution paths, analyzer does not do that. And it is also often ambiguous on a single path that which step introduced the problem.</div><div>Max mentioned using CSA in education. One of the problems he runs into is regarding the dependencies between checks and he would like to have a way to disable some of the sinks.There were some discussions whether it is possible to declare dependencies among checks when using plugins.</div><div>Mohannad shared more context why he is interested in source-to-source transformation.</div><div>Tim asked how CSA compares to other analyzers like CppCheck and the participants shared some experiences but it is really hard to compare analyzers objectively.</div><div>Anton asked if clang-tidy would be a good place to start working on a tool that can rewrite #pragma directives into builtin calls. We believe it would be a better place than CSA.<br>We discussed why CSA is not the right tool to reason about reachability. We can use ExprInspectionChecker to see what parts of the code are explored by the analyzer.</div><div>Max mentions students sometimes hitting some false positives when they implement non-trivial structures like doubly linked lists. The CSA team suggests reporting all of the false positives. </div><div>Max also was interested to learn more about the "mark interesting" features. Artem explained how it is used to construct additional notes when building bug reports.</div><div>David shared that GCC's analyzer work on the gimple layer can piggy-back on LTO, but the representation is already somewhat lowered, which can also introduce problems obscuring what the user wrote. </div><div>David color codes the exploded graph nodes in the dumps to make it easier to identify points of interests. </div><div>We also discussed how loops are modeled (heuristics to completely unroll certain loops, and do something akin to widening in abstract interpretation). After that we briefly discussed supporting inline assembly and doing taint analysis.</div><div>Are there benchmarks for the static analyzer? We have some docker based solutions to easily run analyzer over some project, it is in the LLVM repo, `utils/analyzer/SATest.py docker`.</div><div>One can also use csa-testbench from github.</div><div>Max brought up the conservative evaluation that invalidates a large part of the execution state. He advocated for emulating certain system calls more precisely to avoid excessive invalidations. Artem mentioned there are already facilities for doing that but there is always some room for improvements.</div><div>David described how GCC's analyzer works on the high level. The transfer functions can generate both mergeable and unmergeable symbolic values to control what states can be merged and what state cannot.</div><div>Exceptions are a pain point for both analyzers at the moment. Both analyzers have context sensitive program points for doing inter-procedural analysis.</div><div>We discussed the analyzer's inline defensive check heuristics to suppress false positives.</div><div>David explained how he got into creating a static analyzer in GCC (after being the CPython maintainer and being fed up with certain reference counting bugs in badly written CPython extensions and wanted to have an automated solution to find those errors).</div><div>In GCC, the states are mutated in place as opposed to in Clang where most data structures are immutable (that are used by CSA). Bifurcating state was not trivial with in-place mutated state.</div><div>Using gimple David feels like he side-stepped many problems, e,g, how constructors/destructors are represented is more uniform with regular functions calls. But many aggressive optimizations happen early, like some early inlining. Unfortunately, there is no easy way to get a nice, completely unoptimized IR in GCC at the moment. There is a mark-and-sweep GC in GCC that is used in various places. But the analyzer is rarely using the GC for cleaning up memory, it is mostly relying on RAII.</div><div>In CSA many of the objects are reference counted. The symbolic values in CSA are pass by value. </div><div>Symbolic values are internalized in a manager for GCC, so there is only one instance of every symbolic expression, they are deduplicated. </div><div>GCC's analyzer looks into the memory space and if they are different, it assumes they will not alias. </div><div>We discussed how CSA's model is bad at recovering from wrong assumptions about aliasing. </div><div>GCC's analyzer has a way to trigger a break when reaching a certain program point marked with analyzer_break().</div><div>Ideas to deal with aliasing:<br>* prepass to check for equality checks</div><div>* or add new nodes with the equality assumption to the worklist (a new entry to the function), and do not analyze the branch with the wrong assumption</div><div>GCC's static analyzer also has plugins, and there is an example about holding the global lock for CPython modules.</div><div>There are many attributes that can describe the behavior of certain functions. It would be nice to coordinate on them so both GCC and Clang can understand the same set of attributes.</div><div>We discussed Microsoft SAL, attributes, contracts to describe function behavior.</div><div>Clang analyzer supports noreturn, nullability, and some other check-specific attributes.</div><div>GCC has some access attributes to describe buffer accesses. Microsoft is using annotations internally extensively to annotate buffer operations.</div><div>Clang analyzer does not really ask for buffer sizes since it is not doing really deep analysis of loops. It will not attempt to do buffer overflow detection (by default).</div><div>An important attribute to support is the cleanup attribute to avoid false memory leak warnings.</div><div>We described the facilities we have to explain warnings to users, how we construct bug reports. David suggests looking into Explaining static analysis with rule graphs paper.</div><div>Both GCC and Clang deduplicate similar warnings and try to present the one with the shortest feasible path. GCC also tracks the object of interest during path diagnostic creation while walking backwards.</div><div>It would be great to have a dynamic UI for warnings where the user can explore details on demand rather than overwhelming users with information from the ground up. Artem thinks a static analyzer should have an interface which is similar to a time travel debugger. David mentioned it would be fun to have a GDB target so we can use GDB to step through a trace.<br>David worked alone on GCC's analyzer, and only worked for 2,5 years on it. But he had a GSoC student this summer to help him out.</div><div>Artem mentioned that we do many tuning to eliminate false positives and that tuning is depending on what projects the devs used to test the analyzer.</div><div>In GCC, originally every entity like regions or symbolic values had ids, and used those ids to make comparisons easier. Later the ids were replaced with pointers and the code got simpler and a category of bugs disappeared. The meaning of regions also changed over time. In GCC 10 things were stored into the region. In GCC 11 the region is just a description of how to access memory. Two regions can be different descriptions of the same thing and there is a separate mapping from regions to values. That made regions immutable.</div><div>We were covering what kinds of symbolic values are there in GCC and Clang.</div><div>GCC has different regions for label and function pointers. It is fairly similar to Clang's, maybe GCC is a bit more fine grained.</div><div>David was also maintaining the diagnostic subsystem in GCC and implemented the caret style diagnostics. </div><div></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 15 Nov 2021 at 13:46, Artem Dergachev <<a href="mailto:noqnoqneo@gmail.com" target="_blank">noqnoqneo@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
It's 9:30 - 10:30 Wednesday (PST / UTC-8), already up on
<a href="https://llvm.swoogo.com/2021devmtg/agenda" target="_blank">https://llvm.swoogo.com/2021devmtg/agenda</a><br>
<br>
<div>On 11/15/21 3:40 AM, Deep Majumder
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Are we having this? If so, when?</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Oct 28, 2021 at 9:24
PM Gábor Márton <<a href="mailto:martongabesz@gmail.com" target="_blank">martongabesz@gmail.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">+ Randell<br>
<div><br>
</div>
<div>
<div dir="ltr">Hi Randell,
<div><br>
</div>
<div>Thank you for your email, I am forwarding it to the
list.</div>
<div><br>
</div>
<div>> Is the list set up to block new subscribers
from posting until moderators review? </div>
<div>I really don't know, maybe someone in the list will
know.</div>
<div><br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Oct 28, 2021
at 3:41 PM Randell Jesup <<a href="mailto:rjesup@mozilla.com" target="_blank">rjesup@mozilla.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>On 10/26/2021 4:09 AM, Gábor Márton via cfe-dev
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Hi CSA developers,
<div><br>
</div>
<div>I've submitted a round table request for
the upcoming Dev Meeting (Nov 17-19). Would be
great to have a discussion.</div>
<div>Please also invite colleagues who you think
might be interested.</div>
</div>
</blockquote>
<p><br>
</p>
<p>Hi Gabor. I recently joined the cfe-dev mailing
list, but have been unable to post to it. Is the
list set up to block new subscribers from posting
until moderators review? Thanks</p>
<p><br>
</p>
<p>This is what I was trying to send:</p>
<p>Subject: Thread-safety analysis rough edges<br>
</p>
<p>I've been working with -Wthread-safety, and have
run into a few rough edges. <br>
</p>
<p>One is RAII unlockers. As stated in the known
limitations, it doesn't handle an RAII unlocker
and gets very confused, leading to follow-on false
positives. Is the only reasonable solution to
simply not annotating the RAII unlocker class, and
live with the analysis being wrong during the
unlocked section?</p>
<p>Is there any ongoing work to resolve this issue?</p>
<p>I notice the work done by WebKit to use this
functionality to do static thread assertions (<a href="https://webkit-search.igalia.com/webkit/source/Source/WTF/wtf/ThreadAssertions.h" target="_blank">https://webkit-search.igalia.com/webkit/source/Source/WTF/wtf/ThreadAssertions.h</a>).
There seems to be some value here (witness the
shift from lock-centric names), but examples on
how to use it would be good, similar to the
mutex.h in the docs.</p>
<p>Related: There are a number of usage patterns for
Mutexes that don't lend themselves easily to
thread-safety annotations. An example would be a
item written to from only a single thread, but
read from other threads. The lock must be held
to write it, and all off-writer-thread accesses
must lock to access it. However, on-writer-thread
accesses *don't* need to lock, and will generate
false positives. (There are other Mutex patterns,
like free access until the item is made available
to other threads, or after all other threads are
known to have exited, and more, which aren't
easily covered.)</p>
<p>What's the best way to handle this, other than
not adding GUARDED_BY() or using
NO_THREAD_SAFETY_ANALYSIS? Could we mark an item
as requiring one of a set of capabilities? (i.e.
on the correct thread OR holds the mutex?)</p>
<p>Thanks,</p>
Randell Jesup, Mozilla</div>
</blockquote>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Oct 28, 2021 at
12:23 AM Artem Dergachev <<a href="mailto:noqnoqneo@gmail.com" target="_blank">noqnoqneo@gmail.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">+Andrew and Bruno who
attended our tiny cozy static analyzer round table <br>
at the bay area meetup!<br>
<br>
Andrew, you have some notes from that round table, do you
think it makes <br>
sense to share them in this mailing list thread?<br>
<br>
On 10/26/21 12:26 PM, Artem Dergachev wrote:<br>
> +Deep because he expressed interest.<br>
><br>
> Yay! Yes, absolutely, let's have that.<br>
><br>
> On 10/26/21 1:09 AM, Gábor Márton wrote:<br>
>> Hi CSA developers,<br>
>><br>
>> I've submitted a round table request for the
upcoming Dev Meeting <br>
>> (Nov 17-19). Would be great to have a discussion.<br>
>> Please also invite colleagues who you think
might be interested.<br>
>><br>
>> Thanks,<br>
>> Gabor<br>
><br>
<br>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
<br>
</div>
</blockquote></div>