[PATCH] D82445: [analyzer][solver] Track symbol equivalence

Thu Jun 25 06:53:14 PDT 2020

NoQ added inline comments.

================
Comment at: clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp:537
+  // true for equality and false for disequality.
+  bool IsEquality = true;
+
----------------
vsavchenko wrote:
> NoQ wrote:
> > Do i understand correctly that this isn't used yet and it's for the later patches?
> Not exactly, it is used in two symmetric cases:
>   # We assumed a condition and we try to understand if what we assumed is an equality operation
>   # We try understand something about a symbol and we want to understand if it is an equality operation
> 
> So, in the first case, the branch covering `IsEquality == false` does nothing and is designed for the later patches.
> 
> The second case, however, does work right now.  If we see an equality operation where operands are known to be a part of the same class, we can tell for sure the result of the comparison.  This way `a == b` is `true` and `a != b` is `false`.  You can find this logic in `getRangeForEqualities`.
Ok, makes sense!

================
Comment at: clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp:1603-1604
 ProgramStateRef
 RangeConstraintManager::removeDeadBindings(ProgramStateRef State,
                                            SymbolReaper &SymReaper) {
+  ClassMembersTy ClassMembersMap = State->get<ClassMembers>();
----------------
vsavchenko wrote:
> NoQ wrote:
> > Ok, this turned out to be much scarier than i expected. At least, can we somehow assert that our data structures remain internally consistent after these operations? I.e., things like "a symbol points to an equivalence class iff it belongs to the set of members of that class", etc.
> Assertion like this might cost us double of what we have in this function right now.
Sounds pretty amazing and worth every microsecond.

Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D82445/new/

https://reviews.llvm.org/D82445