8sa1-gcc/gcc/analyzer/feasible-graph.h
David Malcolm 3857edb5d3 analyzer: new implementation of shortest feasible path [PR96374]
The analyzer builds an exploded graph of (point,state) pairs and when
it finds a problem, records a diagnostic at the relevant exploded node.
Once it has finished exploring the graph, the analyzer needs to generate
the shortest feasible path through the graph to each diagnostic's node.
This is used:
- for rejecting diagnostics that are infeasible (due to impossible sets
  of constraints),
- for use in determining which diagnostic to use in each deduplication
  set (the one with the shortest path), and
- for building checker_paths for the "winning" diagnostics, giving a
  list of events

Prior to this patch the analyzer simply found the shortest path to the
node, and then checked it for feasibility, which could lead to falsely
rejecting diagnostics: "the shortest path, if feasible" is not the same
as "the shortest feasible path" (PR analyzer/96374).
An example is PR analyzer/93355, where this issue causes the analyzer
to fail to emit a leak warning for a missing fclose on an error-handling
path in intl/localealias.c.

This patch implements a new algorithm for finding the shortest feasible
path to an exploded node: instead of simply finding the shortest path,
the new algorithm uses a worklist to iteratively build a tree of path
prefixes, which are feasible paths by construction, until a path to the
target node is found.  The worklist is prioritized, so that the first
feasible path discovered is the shortest possible feasible path.  The
algorithm continues trying paths until the target node is reached or a
limit is exceeded, in which case the diagnostic is treated as being
infeasible (which could still be a false negative, but is much less
likely to happen than before).  Iteratively building a tree of paths
allows for work to be reused, and the tree can be dumped in .dot form
(via a new -fdump-analyzer-feasibility option), making it much easier to
debug compared to other approaches I tried.

Doing so fixes the missing leak warning for PR analyzer/93355 and
various other test cases.

Testing:
- I manually verified that the behavior is determistic using 50 builds
  of pr93355-localealias.c.  All dumps were identical.
- I manually verified that it still builds with --disable-analyzer.
- Lightly tested with valgrind; no additional issues.
- Lightly performance tested, showing a slight speed regression to the
  analyzer relative to before the patch, but correctness for this issue
  is more important than the slight performance hit for the analyzer.

gcc/ChangeLog:
	PR analyzer/96374
	* Makefile.in (ANALYZER_OBJS): Add analyzer/feasible-graph.o and
	analyzer/trimmed-graph.o.
	* doc/analyzer.texi (Analyzer Paths): Rewrite description of
	feasibility checking to reflect new implementation.
	* doc/invoke.texi (-fdump-analyzer-feasibility): Document new
	option.
	* shortest-paths.h (shortest_paths::get_shortest_distance): New.

gcc/analyzer/ChangeLog:
	PR analyzer/96374
	* analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
	(fdump-analyzer-feasibility): New flag.
	* diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
	"analyzer/feasible-graph.h".
	(epath_finder::epath_finder): Convert m_sep to a pointer and
	only create it if !flag_analyzer_feasibility.
	(epath_finder::~epath_finder): New.
	(epath_finder::m_sep): Convert to a pointer.
	(epath_finder::get_best_epath): Add param "diag_idx" and use it
	when logging.  Rather than finding the shortest path and then
	checking feasibility, instead use explore_feasible_paths unless
	!flag_analyzer_feasibility, in which case simply use the shortest
	path, and note if it is infeasible.  Update for m_sep becoming a
	pointer.
	(class feasible_worklist): New.
	(epath_finder::explore_feasible_paths): New.
	(epath_finder::process_worklist_item): New.
	(class dump_eg_with_shortest_path): New.
	(epath_finder::dump_trimmed_graph): New.
	(epath_finder::dump_feasible_graph): New.
	(saved_diagnostic::saved_diagnostic): Add "idx" param, using it
	on new field m_idx.
	(saved_diagnostic::to_json): Dump m_idx.
	(saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
	Remove assertion that m_problem was set when m_best_epath is NULL.
	(diagnostic_manager::add_diagnostic): Pass an index when created
	saved_diagnostic instances.
	* diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
	"idx" param.
	(saved_diagnostic::get_index): New accessor.
	(saved_diagnostic::m_idx): New field.
	* engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
	Move code to...
	(exploded_node::dump_processed_stmts): ...this new function and...
	(exploded_node::dump_saved_diagnostics): ...this new function.
	Add index of each diagnostic.
	(exploded_edge::dump_dot):  Move bulk of code to...
	(exploded_edge::dump_dot_label): ...this new function.
	* exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
	vfunc.
	(exploded_node::dump_processed_stmts): New decl.
	(exploded_node::dump_saved_diagnostics): New decl.
	(exploded_edge::dump_dot_label): New decl.
	* feasible-graph.cc: New file.
	* feasible-graph.h: New file.
	* trimmed-graph.cc: New file.
	* trimmed-graph.h: New file.

gcc/testsuite/ChangeLog:
	PR analyzer/96374
	* gcc.dg/analyzer/dot-output.c: Add -fdump-analyzer-feasibility
	to options.
	* gcc.dg/analyzer/feasibility-1.c (test_6): Remove xfail.
	(test_7): New.
	* gcc.dg/analyzer/pr93355-localealias-feasibility-2.c: Remove xfail.
	* gcc.dg/analyzer/pr93355-localealias-feasibility-3.c: Remove xfails.
	* gcc.dg/analyzer/pr93355-localealias-feasibility.c: Remove
	-fno-analyzer-feasibility from options.
	* gcc.dg/analyzer/pr93355-localealias.c: Likewise.
	* gcc.dg/analyzer/unknown-fns-4.c: Remove xfail.
2021-03-11 17:46:37 -05:00

214 lines
5.5 KiB
C++

/* A graph for exploring trees of feasible paths through the egraph.
Copyright (C) 2021 Free Software Foundation, Inc.
Contributed by David Malcolm <dmalcolm@redhat.com>.
This file is part of GCC.
GCC is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3, or (at your option)
any later version.
GCC is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with GCC; see the file COPYING3. If not see
<http://www.gnu.org/licenses/>. */
#ifndef GCC_ANALYZER_FEASIBLE_GRAPH_H
#define GCC_ANALYZER_FEASIBLE_GRAPH_H
namespace ana {
/* Forward decls. */
class base_feasible_node;
class feasible_node;
class infeasible_node;
class base_feasible_edge;
class feasible_edge;
class infeasible_edge;
class feasible_graph;
class feasible_cluster;
/* A traits class for feasible_graph. */
struct fg_traits
{
typedef base_feasible_node node_t;
typedef base_feasible_edge edge_t;
typedef feasible_graph graph_t;
struct dump_args_t
{
typedef typename eg_traits::dump_args_t inner_args_t;
dump_args_t (const inner_args_t &inner_args)
: m_inner_args (inner_args)
{
}
const inner_args_t &m_inner_args;
};
typedef feasible_cluster cluster_t;
};
/* Base class of node within a feasible_graph.
There can be 0 or more base_feasible_nodes per exploded_node. */
class base_feasible_node : public dnode<fg_traits>
{
public:
void dump_dot_id (pretty_printer *pp) const;
const exploded_node *get_inner_node () const { return m_inner_node; }
unsigned get_index () const { return m_index; }
protected:
base_feasible_node (const exploded_node *inner_node, unsigned index)
: m_inner_node (inner_node), m_index (index)
{}
const exploded_node *m_inner_node;
unsigned m_index;
};
/* Subclass of base_feasible_node for a node that is reachable via a
feasible path, with a particular state. */
class feasible_node : public base_feasible_node
{
public:
feasible_node (const exploded_node *inner_node, unsigned index,
const feasibility_state &state,
unsigned path_length)
: base_feasible_node (inner_node, index),
m_state (state),
m_path_length (path_length)
{
}
void dump_dot (graphviz_out *gv,
const dump_args_t &args) const FINAL OVERRIDE;
const feasibility_state &get_state () const { return m_state; }
const region_model &get_model () const { return m_state.get_model (); }
const auto_sbitmap &get_snodes_visited () const
{
return m_state.get_snodes_visited ();
}
unsigned get_path_length () const { return m_path_length; }
private:
feasibility_state m_state;
unsigned m_path_length;
};
/* Subclass of base_feasible_node for a node that requires following
an infeasible edge to reach (and thus terminating this part of the
exploration). */
class infeasible_node : public base_feasible_node
{
public:
infeasible_node (const exploded_node *inner_node, unsigned index,
const rejected_constraint &rc)
: base_feasible_node (inner_node, index),
m_rc (rc)
{
}
void dump_dot (graphviz_out *gv,
const dump_args_t &args) const FINAL OVERRIDE;
private:
rejected_constraint m_rc;
};
/* Base class of edge within a feasible_graph. */
class base_feasible_edge : public dedge<fg_traits>
{
public:
void dump_dot (graphviz_out *gv,
const dump_args_t &args) const FINAL OVERRIDE;
const exploded_edge *get_inner_edge () const { return m_inner_edge; }
protected:
base_feasible_edge (base_feasible_node *src, base_feasible_node *dest,
const exploded_edge *inner_edge)
: dedge<fg_traits> (src, dest), m_inner_edge (inner_edge)
{
}
const exploded_edge *m_inner_edge;
};
/* Subclass of base_feasible_edge for connecting two feasible_nodes. */
class feasible_edge : public base_feasible_edge
{
public:
feasible_edge (feasible_node *src, feasible_node *dest,
const exploded_edge *inner_edge)
: base_feasible_edge (src, dest, inner_edge)
{
}
};
/* Subclass of base_feasible_edge for connecting a feasible_node
to an infeasible_node (and thus terminating this part of the
exploration). */
class infeasible_edge : public base_feasible_edge
{
public:
infeasible_edge (feasible_node *src, infeasible_node *dest,
const exploded_edge *inner_edge)
: base_feasible_edge (src, dest, inner_edge)
{
}
};
/* A digraph subclass for exploring trees of feasible paths through
the egraph. This is actually a tree.
The paths within the graph of feasible_nodes express feasible paths
through the graph, and it also captures known infeasible edges,
which is invaluable for debugging. */
class feasible_graph : public digraph <fg_traits>
{
public:
feasible_graph ();
feasible_node *add_node (const exploded_node *enode,
const feasibility_state &state,
unsigned path_length);
void add_feasibility_problem (feasible_node *src_fnode,
const exploded_edge *eedge,
const rejected_constraint &rc);
exploded_path *make_epath (feasible_node *fnode) const;
unsigned get_num_infeasible () const { return m_num_infeasible; }
void log_stats (logger *logger) const;
private:
unsigned m_num_infeasible;
};
class feasible_cluster : public cluster <fg_traits>
{
};
} // namespace ana
#endif /* GCC_ANALYZER_FEASIBLE_GRAPH_H */