[all-commits] [llvm/llvm-project] 527fcb: [analyzer] Add std::variant checker (#66481)

[Gábor Spaits via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 527fcb8e5d6b1d491b6699cde818db1127bbb12c
      https://github.com/llvm/llvm-project/commit/527fcb8e5d6b1d491b6699cde818db1127bbb12c
  Author: Gábor Spaits <48805437+spaits at users.noreply.github.com>
  Date:   2023-11-21 (Tue, 21 Nov 2023)

  Changed paths:
    M clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
    M clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
    M clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt
    A clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
    A clang/lib/StaticAnalyzer/Checkers/TaggedUnionModeling.h
    M clang/lib/StaticAnalyzer/Core/CallEvent.cpp
    M clang/test/Analysis/Inputs/system-header-simulator-cxx.h
    M clang/test/Analysis/diagnostics/explicit-suppression.cpp
    A clang/test/Analysis/std-variant-checker.cpp

  Log Message:
  -----------
  [analyzer] Add std::variant checker (#66481)

As my BSc thesis I've implemented a checker for std::variant and
std::any, and in the following weeks I'll upload a revised version of
them here.

# Prelude

@Szelethus and I sent out an email with our initial plans here:
https://discourse.llvm.org/t/analyzer-new-checker-for-std-any-as-a-bsc-thesis/65613/2
We also created a stub checker patch here:
https://reviews.llvm.org/D142354.

Upon the recommendation of @haoNoQ , we explored an option where instead
of writing a checker, we tried to improve on how the analyzer natively
inlined the methods of std::variant and std::any. Our attempt is in this
patch https://reviews.llvm.org/D145069, but in a nutshell, this is what
happened: The analyzer was able to model much of what happened inside
those classes, but our false positive suppression machinery erroneously
suppressed it. After months of trying, we could not find a satisfying
enhancement on the heuristic without introducing an allowlist/denylist
of which functions to not suppress.

As a result (and partly on the encouragement of @Xazax-hun) I wrote a
dedicated checker!

The advantage of the checker is that it is not dependent on the
standard's implementation and won't put warnings in the standard library
definitions. Also without the checker it would be difficult to create
nice user-friendly warnings and NoteTags -- as per the standard's
specification, the analysis is sinked by an exception, which we don't
model well now.

# Design ideas

The working of the checker is straightforward: We find the creation of
an std::variant instance, store the type of the variable we want to
store in it, then save this type for the instance. When retrieving type
from the instance we check what type we want to retrieve as, and compare
it to the actual type. If the two don't march we emit an error.

Distinguishing variants by instance (e.g. MemRegion *) is not the most
optimal way. Other checkers, like MallocChecker uses a symbol-to-trait
map instead of region-to-trait. The upside of using symbols (which would
be the value of a variant, not the variant itself itself) is that the
analyzer would take care of modeling copies, moves, invalidation, etc,
out of the box. The problem is that for compound types, the analyzer
doesn't create a symbol as a result of a constructor call that is fit
for this job. MallocChecker in contrast manipulates simple pointers.

My colleges and I considered the option of making adjustments directly
to the memory model of the analyzer, but for the time being decided
against it, and go with the bit more cumbersome, but immediately viable
option of simply using MemRegions.

# Current state and review plan

This patch contains an already working checker that can find and report
certain variant/any misuses, but still lands it in alpha. I plan to
upload the rest of the checker in later patches.

The full checker is also able to "follow" the symbolic value held by the
std::variant and updates the program state whenever we assign the value
stored in the variant. I have also built a library that is meant to
model union-like types similar to variant, hence some functions being a
bit more multipurpose then is immediately needed.

I also intend to publish my std::any checker in a later commit.

---------

Co-authored-by: Gabor Spaits <gabor.spaits at ericsson.com>
Co-authored-by: Balazs Benics <benicsbalazs at gmail.com>