[llvm-bugs] [Bug 34868] New: Add attribute for asserting that memory is valid

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=34868

            Bug ID: 34868
           Summary: Add attribute for asserting that memory is valid
           Product: clang
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: akrzemi1 at gmail.com
                CC: llvm-bugs at lists.llvm.org

BACKGROUND:

The following page provides a set of hints for disabling false positives
returned from static-analyzer: http://clang-analyzer.llvm.org/faq.html

Using an `assert` is very elegant; and using `#define`, although not elegant is
a good last resort that makes in possible to disable practically any warning.

Yet, there is a class of false positives that cannot be disabled with an
`assert` and are to specific/focused to qualify for a #define, namely the
problems with memory used after free. 

I recently got hit by the following false positive:
https://github.com/google/googletest/issues/853
It had already been described, and a corresponding bug report filed under
https://bugs.llvm.org/show_bug.cgi?id=28053 15 months ago.

What would help me here is if clang provided an additional attribute, like
`__attribute__((analyzer_memory_valid))`, which I could use to instruct the
analyzer that memory under given address is valid at this point, regardless of
what the analyzer has concluded.

I had a different false positive recently in my job. I cannot make a
self-contained example, because the bug manifested only in big portions of
code, using a number of libraries, and each time I tried to reduce it, the bug
disappeared. But it basically said that the re is a risk memory would not be
freed if some exception was thrown (but the memory in question was guarded by a
std::unique_ptr). What I was missing was another attribute, like
`__attribute__((analyzer_memory_will_be_freed))` wherewith I could overwrite
the conclusion from the static analyzer.

FEATURE REQUEST:

Provide two additional attributes for the static analyzer, where I can add
manual input to the analysis as to when memory is valid, and that it will be
freed:

`__attribute__((analyzer_memory_valid))` -- this means that at this point of
execution the memory under the annotated pointer is valid (in particular: not
freed yet).

`__attribute__((analyzer_memory_will_be_freed))` -- this means that the memory
under the annotated address will be freed, even if the analyzer fails to see
it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20171007/3bc8784b/attachment.html>