mbox series

[00/45] v4 of analyzer patch kit

Message ID 20191213181134.1830-1-dmalcolm@redhat.com
Headers show
Series v4 of analyzer patch kit | expand

Message

David Malcolm Dec. 13, 2019, 6:10 p.m. UTC 
Here's an updated version of the patch kit, addressing many issues from
review, and squashing in other changes.

This is v4, and is relative to r279310 (2019-12-12)
Earlier versions:
v3: https://gcc.gnu.org/ml/gcc-patches/2019-12/msg00529.html
v2: https://gcc.gnu.org/ml/gcc-patches/2019-11/msg02024.html
v1: https://gcc.gnu.org/ml/gcc-patches/2019-11/msg01543.html

See also: https://gcc.gnu.org/wiki/DavidMalcolm/StaticAnalyzer


High-level changes (relative to v1):
- dropped the in-tree plugin idea; the analyzer is now part of the
  compiler
- added a configure-time way to disable the build of the compiler.
  It is built by default (but off by default at compile-time);
  all of the analyzer-specific code is guarded by
  #if ENABLE_ANALYZER
- moved some files from "gcc/analyzer" to "gcc" (digraph.cc.h,
  graphviz.cc/h, shortest-paths.h, and tristate.cc/h).
  I've kept the "gcc/analyzer" subdirectory.  I assume that it's sane
  to have a gcc/analyzer subdirectory, and that it ought to have its
  own ChangeLog file (it doesn't yet).
- renamed the option from --analyzer to -fanalyzer; -fno-analyzer is
  now supported (and the last one wins)
- fixed the LTO crasher, so basic cross-TU analysis via "-flto -fanalyzer"
  works
- added a new sm-signal.cc for detecting fprintf calls in signal
  handlers, along with various cleanups and generalizations this needed
  (which will be helpful long-term for e.g. C++ exception support)
- I've already committed some of v1's approved preliminary patches to
  trunk


Other changes:
- the various fixups needed due to rebasing (changes to param-handling,
  json API)
- rewrote .dot output to avoid shape=record, as it's poorly supported
  in more recent versions of GraphViz
- fixed missing leak diagnostic on longjmp past a free, and show the
  rewind destination for this case
- fixed issues in diagnostic_manager::prune_path
- added an sm-malloc.dot to visualize the state machine
- added more internal validation
- better support for resolving function pointers
- added DISABLE_COPY_AND_ASSIGN in various places
- split diagnostic_manager::prune_path into subroutines as per review
- special-case strcmp calls when describing edge events (I found this
  helpful for debugging the reproducer for detecting CVE-2005-1689)
- added a test for .dot output to the testsuite, with directives such as:
     /* { dg-require-dot "" } */
  and
     /* { dg-final { dg-check-dot "dot-output.c.callgraph.dot" } } */
- dropped all those //// comment lines


Not yet changed:
- this currently needs the fix to hash_table::empty_slow from:
    https://gcc.gnu.org/ml/gcc-patches/2019-12/msg00776.html
  which I still need to gather info about
- I've experimented with eliminating make_label_text, and have something
  that works, but the patch currently has a lot warnings, so am deferring
  for now
- struct vs class in exploded-graph.h
- probably other things


Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to the git mirror as branch "dmalcolm/analyzer-v4":
  https://gcc.gnu.org/git/?p=gcc.git;a=shortlog;h=refs/heads/dmalcolm/analyzer-v4


Dave

David Malcolm (45):
  gimple const-correctness fixes
  hash-map-tests.c: add a selftest involving int_hash
  analyzer: user-facing documentation
  analyzer: internal documentation
  Add pp_write_text_as_html_like_dot_to_stream
  sbitmap.h: add operator const sbitmap & to auto_sbitmap
  vec.h: add auto_delete_vec
  Add -fdiagnostics-nn-line-numbers
  Add diagnostic_metadata and CWE support
  Add diagnostic paths
  Add ordered_hash_map
  timevar.def: add TVs for analyzer
  analyzer: changes to configure.ac
  analyzer: add new files to Makefile.in
  analyzer: new files: analyzer-selftests.{cc|h}
  analyzer: new builtins
  analyzer: command-line options
  analyzer: logging support
  analyzer: new file: analyzer-pass.cc and pass registration
  analyzer: new files: graphviz.{cc|h}
  analyzer: new files: digraph.{cc|h} and shortest-paths.h
  analyzer: new files: supergraph.{cc|h}
  analyzer: new files: analyzer.{cc|h}
  analyzer: new files: tristate.{cc|h}
  analyzer: new files: constraint-manager.{cc|h}
  analyzer: new files: region-model.{cc|h}
  analyzer: new files: pending-diagnostic.{cc|h}
  analyzer: new files: sm.{cc|h}
  analyzer: new files: sm-malloc.cc and sm-malloc.dot
  analyzer: new file: sm-file.cc
  analyzer: new file: sm-pattern-test.cc
  analyzer: new file: sm-sensitive.cc
  analyzer: new file: sm-signal.cc
  analyzer: new file: sm-taint.cc
  analyzer: new files: analysis-plan.{cc|h}
  analyzer: new files: call-string.{cc|h}
  analyzer: new files: program-point.{cc|h}
  analyzer: new files: program-state.{cc|h}
  analyzer: new file: exploded-graph.h
  analyzer: new files: state-purge.{cc|h}
  analyzer: new files: engine.{cc|h}
  analyzer: new files: checker-path.{cc|h}
  analyzer: new files: diagnostic-manager.{cc|h}
  gdbinit.in: add break-on-saved-diagnostic
  analyzer: test suite

 gcc/Makefile.in                               |   36 +-
 gcc/analyzer/analysis-plan.cc                 |  118 +
 gcc/analyzer/analysis-plan.h                  |   58 +
 gcc/analyzer/analyzer-logging.cc              |  224 +
 gcc/analyzer/analyzer-logging.h               |  262 +
 gcc/analyzer/analyzer-pass.cc                 |  102 +
 gcc/analyzer/analyzer-selftests.cc            |   60 +
 gcc/analyzer/analyzer-selftests.h             |   44 +
 gcc/analyzer/analyzer.cc                      |  150 +
 gcc/analyzer/analyzer.h                       |  124 +
 gcc/analyzer/analyzer.opt                     |  181 +
 gcc/analyzer/call-string.cc                   |  224 +
 gcc/analyzer/call-string.h                    |   76 +
 gcc/analyzer/checker-path.cc                  |  931 ++
 gcc/analyzer/checker-path.h                   |  589 ++
 gcc/analyzer/constraint-manager.cc            | 2251 +++++
 gcc/analyzer/constraint-manager.h             |  248 +
 gcc/analyzer/diagnostic-manager.cc            | 1217 +++
 gcc/analyzer/diagnostic-manager.h             |  137 +
 gcc/analyzer/engine.cc                        | 3583 ++++++++
 gcc/analyzer/engine.h                         |   26 +
 gcc/analyzer/exploded-graph.h                 |  830 ++
 gcc/analyzer/pending-diagnostic.cc            |   64 +
 gcc/analyzer/pending-diagnostic.h             |  269 +
 gcc/analyzer/program-point.cc                 |  529 ++
 gcc/analyzer/program-point.h                  |  313 +
 gcc/analyzer/program-state.cc                 | 1331 +++
 gcc/analyzer/program-state.h                  |  365 +
 gcc/analyzer/region-model.cc                  | 7773 +++++++++++++++++
 gcc/analyzer/region-model.h                   | 2065 +++++
 gcc/analyzer/sm-file.cc                       |  334 +
 gcc/analyzer/sm-malloc.cc                     |  794 ++
 gcc/analyzer/sm-malloc.dot                    |   89 +
 gcc/analyzer/sm-pattern-test.cc               |  149 +
 gcc/analyzer/sm-sensitive.cc                  |  245 +
 gcc/analyzer/sm-signal.cc                     |  306 +
 gcc/analyzer/sm-taint.cc                      |  325 +
 gcc/analyzer/sm.cc                            |  136 +
 gcc/analyzer/sm.h                             |  182 +
 gcc/analyzer/state-purge.cc                   |  525 ++
 gcc/analyzer/state-purge.h                    |  164 +
 gcc/analyzer/supergraph.cc                    |  955 ++
 gcc/analyzer/supergraph.h                     |  564 ++
 gcc/builtins.def                              |   33 +
 gcc/c-family/c-format.c                       |    7 +
 gcc/c-family/c-format.h                       |    1 +
 gcc/common.opt                                |   32 +
 gcc/configure.ac                              |   14 +-
 gcc/coretypes.h                               |    1 +
 gcc/diagnostic-color.c                        |    3 +-
 gcc/diagnostic-core.h                         |   10 +
 gcc/diagnostic-event-id.h                     |   61 +
 gcc/diagnostic-format-json.cc                 |   34 +-
 gcc/diagnostic-metadata.h                     |   42 +
 gcc/diagnostic-path.h                         |  149 +
 gcc/diagnostic-show-locus.c                   |   79 +-
 gcc/diagnostic.c                              |  281 +-
 gcc/diagnostic.def                            |    5 +
 gcc/diagnostic.h                              |   43 +-
 gcc/digraph.cc                                |  188 +
 gcc/digraph.h                                 |  246 +
 gcc/doc/analyzer.texi                         |  496 ++
 gcc/doc/gccint.texi                           |    2 +
 gcc/doc/invoke.texi                           |  615 +-
 gcc/dwarf2out.c                               |    1 +
 gcc/gcc-rich-location.h                       |    4 +-
 gcc/gdbinit.in                                |   10 +
 gcc/gimple-predict.h                          |    4 +-
 gcc/gimple-pretty-print.c                     |  159 +-
 gcc/gimple-pretty-print.h                     |    3 +-
 gcc/gimple.h                                  |  156 +-
 gcc/graphviz.cc                               |  100 +
 gcc/graphviz.h                                |   53 +
 gcc/hash-map-tests.c                          |   41 +
 gcc/lto-wrapper.c                             |    3 +
 gcc/opts.c                                    |   16 +
 gcc/ordered-hash-map-tests.cc                 |  247 +
 gcc/ordered-hash-map.h                        |  184 +
 gcc/passes.def                                |    1 +
 gcc/pretty-print.c                            |   80 +
 gcc/pretty-print.h                            |    3 +
 gcc/sbitmap.h                                 |    1 +
 gcc/selftest-run-tests.c                      |    8 +
 gcc/selftest.h                                |    4 +
 gcc/shortest-paths.h                          |  145 +
 .../gcc.dg/analyzer/CVE-2005-1689-minimal.c   |   30 +
 gcc/testsuite/gcc.dg/analyzer/abort.c         |   71 +
 gcc/testsuite/gcc.dg/analyzer/alloca-leak.c   |    8 +
 .../gcc.dg/analyzer/analyzer-verbosity-0.c    |  162 +
 .../gcc.dg/analyzer/analyzer-verbosity-1.c    |  190 +
 .../gcc.dg/analyzer/analyzer-verbosity-2.c    |  221 +
 gcc/testsuite/gcc.dg/analyzer/analyzer.exp    |   49 +
 .../gcc.dg/analyzer/attribute-nonnull.c       |   81 +
 .../gcc.dg/analyzer/call-summaries-1.c        |   14 +
 .../gcc.dg/analyzer/conditionals-2.c          |   44 +
 .../gcc.dg/analyzer/conditionals-3.c          |   45 +
 .../gcc.dg/analyzer/conditionals-notrans.c    |  158 +
 .../gcc.dg/analyzer/conditionals-trans.c      |  143 +
 gcc/testsuite/gcc.dg/analyzer/data-model-1.c  | 1084 +++
 gcc/testsuite/gcc.dg/analyzer/data-model-10.c |   17 +
 gcc/testsuite/gcc.dg/analyzer/data-model-11.c |    6 +
 gcc/testsuite/gcc.dg/analyzer/data-model-12.c |   13 +
 gcc/testsuite/gcc.dg/analyzer/data-model-13.c |   21 +
 gcc/testsuite/gcc.dg/analyzer/data-model-14.c |   24 +
 gcc/testsuite/gcc.dg/analyzer/data-model-15.c |   34 +
 gcc/testsuite/gcc.dg/analyzer/data-model-16.c |   50 +
 gcc/testsuite/gcc.dg/analyzer/data-model-17.c |   20 +
 gcc/testsuite/gcc.dg/analyzer/data-model-18.c |   20 +
 gcc/testsuite/gcc.dg/analyzer/data-model-19.c |   31 +
 gcc/testsuite/gcc.dg/analyzer/data-model-2.c  |   13 +
 gcc/testsuite/gcc.dg/analyzer/data-model-3.c  |   15 +
 gcc/testsuite/gcc.dg/analyzer/data-model-4.c  |   16 +
 gcc/testsuite/gcc.dg/analyzer/data-model-5.c  |  100 +
 gcc/testsuite/gcc.dg/analyzer/data-model-5b.c |   91 +
 gcc/testsuite/gcc.dg/analyzer/data-model-5c.c |   84 +
 gcc/testsuite/gcc.dg/analyzer/data-model-5d.c |   63 +
 gcc/testsuite/gcc.dg/analyzer/data-model-6.c  |   13 +
 gcc/testsuite/gcc.dg/analyzer/data-model-7.c  |   19 +
 gcc/testsuite/gcc.dg/analyzer/data-model-8.c  |   24 +
 gcc/testsuite/gcc.dg/analyzer/data-model-9.c  |   32 +
 .../gcc.dg/analyzer/data-model-path-1.c       |   13 +
 gcc/testsuite/gcc.dg/analyzer/disabling.c     |   10 +
 gcc/testsuite/gcc.dg/analyzer/dot-output.c    |   33 +
 .../gcc.dg/analyzer/double-free-lto-1-a.c     |   16 +
 .../gcc.dg/analyzer/double-free-lto-1-b.c     |    8 +
 .../gcc.dg/analyzer/double-free-lto-1.h       |    1 +
 gcc/testsuite/gcc.dg/analyzer/equivalence.c   |   29 +
 gcc/testsuite/gcc.dg/analyzer/explode-1.c     |   60 +
 gcc/testsuite/gcc.dg/analyzer/explode-2.c     |   50 +
 gcc/testsuite/gcc.dg/analyzer/factorial.c     |    7 +
 gcc/testsuite/gcc.dg/analyzer/fibonacci.c     |    9 +
 gcc/testsuite/gcc.dg/analyzer/fields.c        |   41 +
 gcc/testsuite/gcc.dg/analyzer/file-1.c        |   37 +
 gcc/testsuite/gcc.dg/analyzer/file-2.c        |   18 +
 .../gcc.dg/analyzer/function-ptr-1.c          |    8 +
 .../gcc.dg/analyzer/function-ptr-2.c          |   43 +
 .../gcc.dg/analyzer/function-ptr-3.c          |   17 +
 gcc/testsuite/gcc.dg/analyzer/gzio-2.c        |   11 +
 gcc/testsuite/gcc.dg/analyzer/gzio-3.c        |   31 +
 gcc/testsuite/gcc.dg/analyzer/gzio-3a.c       |   27 +
 gcc/testsuite/gcc.dg/analyzer/gzio.c          |   17 +
 .../gcc.dg/analyzer/infinite-recursion.c      |   55 +
 gcc/testsuite/gcc.dg/analyzer/loop-2.c        |   36 +
 gcc/testsuite/gcc.dg/analyzer/loop-2a.c       |   39 +
 gcc/testsuite/gcc.dg/analyzer/loop-3.c        |   17 +
 gcc/testsuite/gcc.dg/analyzer/loop-4.c        |   41 +
 gcc/testsuite/gcc.dg/analyzer/loop.c          |   33 +
 gcc/testsuite/gcc.dg/analyzer/malloc-1.c      |  585 ++
 gcc/testsuite/gcc.dg/analyzer/malloc-2.c      |   23 +
 gcc/testsuite/gcc.dg/analyzer/malloc-3.c      |    8 +
 .../gcc.dg/analyzer/malloc-callbacks.c        |   84 +
 gcc/testsuite/gcc.dg/analyzer/malloc-dce.c    |   12 +
 .../gcc.dg/analyzer/malloc-dedupe-1.c         |   46 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c  |   24 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c |   32 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-11.c |   95 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c |    7 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13.c |   30 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c  |   34 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c  |   23 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c  |   13 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c  |   13 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-6.c  |   22 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-7.c  |   29 +
 .../analyzer/malloc-ipa-8-double-free.c       |  172 +
 .../gcc.dg/analyzer/malloc-ipa-8-lto-a.c      |   12 +
 .../gcc.dg/analyzer/malloc-ipa-8-lto-b.c      |   18 +
 .../gcc.dg/analyzer/malloc-ipa-8-lto-c.c      |   17 +
 .../gcc.dg/analyzer/malloc-ipa-8-lto.h        |   12 +
 .../gcc.dg/analyzer/malloc-ipa-8-unchecked.c  |   66 +
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c  |   18 +
 .../analyzer/malloc-macro-inline-events.c     |   45 +
 .../analyzer/malloc-macro-separate-events.c   |   15 +
 gcc/testsuite/gcc.dg/analyzer/malloc-macro.h  |    2 +
 .../gcc.dg/analyzer/malloc-many-paths-1.c     |   14 +
 .../gcc.dg/analyzer/malloc-many-paths-2.c     |   30 +
 .../gcc.dg/analyzer/malloc-many-paths-3.c     |   36 +
 .../gcc.dg/analyzer/malloc-paths-1.c          |   15 +
 .../gcc.dg/analyzer/malloc-paths-10.c         |   19 +
 .../gcc.dg/analyzer/malloc-paths-2.c          |   13 +
 .../gcc.dg/analyzer/malloc-paths-3.c          |   14 +
 .../gcc.dg/analyzer/malloc-paths-4.c          |   20 +
 .../gcc.dg/analyzer/malloc-paths-5.c          |   43 +
 .../gcc.dg/analyzer/malloc-paths-6.c          |   11 +
 .../gcc.dg/analyzer/malloc-paths-7.c          |   21 +
 .../gcc.dg/analyzer/malloc-paths-8.c          |   54 +
 .../gcc.dg/analyzer/malloc-paths-9.c          |  298 +
 .../gcc.dg/analyzer/malloc-vs-local-1a.c      |  180 +
 .../gcc.dg/analyzer/malloc-vs-local-1b.c      |  175 +
 .../gcc.dg/analyzer/malloc-vs-local-2.c       |  178 +
 .../gcc.dg/analyzer/malloc-vs-local-3.c       |   65 +
 .../gcc.dg/analyzer/malloc-vs-local-4.c       |   40 +
 gcc/testsuite/gcc.dg/analyzer/operations.c    |   42 +
 gcc/testsuite/gcc.dg/analyzer/params-2.c      |   16 +
 gcc/testsuite/gcc.dg/analyzer/params.c        |   32 +
 gcc/testsuite/gcc.dg/analyzer/paths-1.c       |   16 +
 gcc/testsuite/gcc.dg/analyzer/paths-1a.c      |   16 +
 gcc/testsuite/gcc.dg/analyzer/paths-2.c       |   25 +
 gcc/testsuite/gcc.dg/analyzer/paths-3.c       |   48 +
 gcc/testsuite/gcc.dg/analyzer/paths-4.c       |   49 +
 gcc/testsuite/gcc.dg/analyzer/paths-5.c       |   10 +
 gcc/testsuite/gcc.dg/analyzer/paths-6.c       |  118 +
 gcc/testsuite/gcc.dg/analyzer/paths-7.c       |   58 +
 .../gcc.dg/analyzer/pattern-test-1.c          |   28 +
 .../gcc.dg/analyzer/pattern-test-2.c          |   29 +
 .../gcc.dg/analyzer/pointer-merging.c         |   16 +
 gcc/testsuite/gcc.dg/analyzer/pr61861.c       |    2 +
 gcc/testsuite/gcc.dg/analyzer/pragma-1.c      |   26 +
 gcc/testsuite/gcc.dg/analyzer/scope-1.c       |   23 +
 gcc/testsuite/gcc.dg/analyzer/sensitive-1.c   |   55 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-1.c      |    1 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-2.c      |   97 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-3.c      |  106 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-4.c      |  107 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-5.c      |   65 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-6.c      |   31 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-7.c      |   36 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-7a.c     |  110 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-8.c      |  107 +
 gcc/testsuite/gcc.dg/analyzer/setjmp-9.c      |  109 +
 gcc/testsuite/gcc.dg/analyzer/signal-1.c      |   31 +
 gcc/testsuite/gcc.dg/analyzer/signal-2.c      |   34 +
 gcc/testsuite/gcc.dg/analyzer/signal-3.c      |   23 +
 gcc/testsuite/gcc.dg/analyzer/signal-4a.c     |   74 +
 gcc/testsuite/gcc.dg/analyzer/signal-4b.c     |   89 +
 gcc/testsuite/gcc.dg/analyzer/strcmp-1.c      |   35 +
 gcc/testsuite/gcc.dg/analyzer/switch.c        |   28 +
 gcc/testsuite/gcc.dg/analyzer/taint-1.c       |  128 +
 gcc/testsuite/gcc.dg/analyzer/zlib-1.c        |   67 +
 gcc/testsuite/gcc.dg/analyzer/zlib-2.c        |   51 +
 gcc/testsuite/gcc.dg/analyzer/zlib-3.c        |  214 +
 gcc/testsuite/gcc.dg/analyzer/zlib-4.c        |   20 +
 gcc/testsuite/gcc.dg/analyzer/zlib-5.c        |   49 +
 gcc/testsuite/gcc.dg/analyzer/zlib-6.c        |   47 +
 gcc/testsuite/gcc.dg/format/gcc_diag-10.c     |    6 +-
 .../plugin/diagnostic-path-format-default.c   |  142 +
 .../diagnostic-path-format-inline-events-1.c  |  142 +
 .../diagnostic-path-format-inline-events-2.c  |  154 +
 .../diagnostic-path-format-inline-events-3.c  |  153 +
 .../plugin/diagnostic-path-format-none.c      |   43 +
 .../diagnostic-path-format-separate-events.c  |   44 +
 .../gcc.dg/plugin/diagnostic-test-paths-1.c   |   38 +
 .../gcc.dg/plugin/diagnostic-test-paths-2.c   |   56 +
 .../gcc.dg/plugin/diagnostic-test-paths-3.c   |   38 +
 .../gcc.dg/plugin/diagnostic-test-paths-4.c   |   83 +
 .../plugin/diagnostic_plugin_test_paths.c     |  460 +
 gcc/testsuite/gcc.dg/plugin/plugin.exp        |   11 +
 gcc/testsuite/lib/gcc-defs.exp                |   21 +
 gcc/testsuite/lib/target-supports-dg.exp      |   10 +
 gcc/testsuite/lib/target-supports.exp         |   21 +
 gcc/timevar.def                               |   11 +
 gcc/toplev.c                                  |    8 +
 gcc/tree-diagnostic-path.cc                   |  820 ++
 gcc/tree-diagnostic.c                         |   12 +-
 gcc/tree-diagnostic.h                         |    8 +
 gcc/tree-eh.c                                 |    6 +-
 gcc/tree-eh.h                                 |    4 +-
 gcc/tree-pass.h                               |    1 +
 gcc/tree-ssa-alias.h                          |    2 +-
 gcc/tree-ssa-structalias.c                    |    2 +-
 gcc/tristate.cc                               |  221 +
 gcc/tristate.h                                |   82 +
 gcc/vec.c                                     |   27 +
 gcc/vec.h                                     |   38 +
 libcpp/include/line-map.h                     |    7 +
 libcpp/line-map.c                             |    3 +-
 266 files changed, 43658 insertions(+), 193 deletions(-)
 create mode 100644 gcc/analyzer/analysis-plan.cc
 create mode 100644 gcc/analyzer/analysis-plan.h
 create mode 100644 gcc/analyzer/analyzer-logging.cc
 create mode 100644 gcc/analyzer/analyzer-logging.h
 create mode 100644 gcc/analyzer/analyzer-pass.cc
 create mode 100644 gcc/analyzer/analyzer-selftests.cc
 create mode 100644 gcc/analyzer/analyzer-selftests.h
 create mode 100644 gcc/analyzer/analyzer.cc
 create mode 100644 gcc/analyzer/analyzer.h
 create mode 100644 gcc/analyzer/analyzer.opt
 create mode 100644 gcc/analyzer/call-string.cc
 create mode 100644 gcc/analyzer/call-string.h
 create mode 100644 gcc/analyzer/checker-path.cc
 create mode 100644 gcc/analyzer/checker-path.h
 create mode 100644 gcc/analyzer/constraint-manager.cc
 create mode 100644 gcc/analyzer/constraint-manager.h
 create mode 100644 gcc/analyzer/diagnostic-manager.cc
 create mode 100644 gcc/analyzer/diagnostic-manager.h
 create mode 100644 gcc/analyzer/engine.cc
 create mode 100644 gcc/analyzer/engine.h
 create mode 100644 gcc/analyzer/exploded-graph.h
 create mode 100644 gcc/analyzer/pending-diagnostic.cc
 create mode 100644 gcc/analyzer/pending-diagnostic.h
 create mode 100644 gcc/analyzer/program-point.cc
 create mode 100644 gcc/analyzer/program-point.h
 create mode 100644 gcc/analyzer/program-state.cc
 create mode 100644 gcc/analyzer/program-state.h
 create mode 100644 gcc/analyzer/region-model.cc
 create mode 100644 gcc/analyzer/region-model.h
 create mode 100644 gcc/analyzer/sm-file.cc
 create mode 100644 gcc/analyzer/sm-malloc.cc
 create mode 100644 gcc/analyzer/sm-malloc.dot
 create mode 100644 gcc/analyzer/sm-pattern-test.cc
 create mode 100644 gcc/analyzer/sm-sensitive.cc
 create mode 100644 gcc/analyzer/sm-signal.cc
 create mode 100644 gcc/analyzer/sm-taint.cc
 create mode 100644 gcc/analyzer/sm.cc
 create mode 100644 gcc/analyzer/sm.h
 create mode 100644 gcc/analyzer/state-purge.cc
 create mode 100644 gcc/analyzer/state-purge.h
 create mode 100644 gcc/analyzer/supergraph.cc
 create mode 100644 gcc/analyzer/supergraph.h
 create mode 100644 gcc/diagnostic-event-id.h
 create mode 100644 gcc/diagnostic-metadata.h
 create mode 100644 gcc/diagnostic-path.h
 create mode 100644 gcc/digraph.cc
 create mode 100644 gcc/digraph.h
 create mode 100644 gcc/doc/analyzer.texi
 create mode 100644 gcc/graphviz.cc
 create mode 100644 gcc/graphviz.h
 create mode 100644 gcc/ordered-hash-map-tests.cc
 create mode 100644 gcc/ordered-hash-map.h
 create mode 100644 gcc/shortest-paths.h
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/CVE-2005-1689-minimal.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/abort.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/alloca-leak.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-0.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer-verbosity-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/analyzer.exp
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/attribute-nonnull.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/call-summaries-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-notrans.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/conditionals-trans.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-10.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-11.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-12.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-13.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-14.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-15.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-16.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-17.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-18.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-19.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5b.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5c.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-5d.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-6.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-7.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-8.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-9.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-path-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/disabling.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/dot-output.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1-a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1-b.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/double-free-lto-1.h
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/equivalence.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/explode-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/explode-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/factorial.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/fibonacci.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/fields.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/file-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/file-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/function-ptr-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio-3a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/gzio.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/infinite-recursion.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-2a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-callbacks.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-dce.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-dedupe-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-10.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-11.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-12.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-13.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-6.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-7.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-b.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto-c.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-lto.h
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-9.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro-inline-events.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro-separate-events.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-macro.h
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-10.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-6.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-7.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-8.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-1b.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/malloc-vs-local-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/operations.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/params-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/params.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-1a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-6.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/paths-7.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pattern-test-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pattern-test-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pointer-merging.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr61861.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pragma-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/scope-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/sensitive-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-6.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-7.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-7a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-8.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/setjmp-9.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-4a.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/signal-4b.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/strcmp-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/switch.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-1.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-5.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/zlib-6.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-default.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-1.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-2.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-inline-events-3.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-none.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-path-format-separate-events.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-1.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-2.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-3.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic-test-paths-4.c
 create mode 100644 gcc/testsuite/gcc.dg/plugin/diagnostic_plugin_test_paths.c
 create mode 100644 gcc/tree-diagnostic-path.cc
 create mode 100644 gcc/tristate.cc
 create mode 100644 gcc/tristate.h