From 86ac81c2ac9b27313a15eee1b14203be11f7646b Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Sat, 18 May 2019 06:49:05 -0400
Subject: [PATCH 55/66] FIXME: 2019-05-18: WIP on data model

---
 gcc/analyzer/region-model.cc                          |  6 ++++--
 .../analyzer/NOT_FOR_UPSTREAM-clang-paper-example-4.c | 19 ++++++++++++++++++-
 gcc/testsuite/gcc.dg/analyzer/data-model-1.c          | 12 ++++++++++--
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index a7a81c5..510e18d 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -1930,7 +1930,7 @@ region_model::eval_condition (svalue_id lhs_sid,
 
   /* FIXME: this is a very simplistic implementation.  */
 
-#if 0
+#if 1
   unsigned i;
   svalue_constraint *c;
   FOR_EACH_VEC_ELT (m_constraints, i, c)
@@ -2456,11 +2456,13 @@ test_constraint_conditions ()
 
     ADD_SAT_CONSTRAINT (model, x, EQ_EXPR, y);
 
-#if 0
     ASSERT_CONDITION_TRUE (model, x, EQ_EXPR, y);
+#if 0
     ASSERT_CONDITION_TRUE (model, x, LE_EXPR, y);
     ASSERT_CONDITION_TRUE (model, x, GE_EXPR, y);
+#endif
     ASSERT_CONDITION_FALSE (model, x, NE_EXPR, y);
+#if 0
     ASSERT_CONDITION_FALSE (model, x, LT_EXPR, y);
     ASSERT_CONDITION_FALSE (model, x, GT_EXPR, y);
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-clang-paper-example-4.c b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-clang-paper-example-4.c
index 8516837..818166c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-clang-paper-example-4.c
+++ b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-clang-paper-example-4.c
@@ -1,3 +1,5 @@
+/* { dg-additional-options "-fanalyzer-region-model" } */
+
 #include <stddef.h>
 
 struct s { int data[2]; };
@@ -9,6 +11,21 @@ void test_4 (struct s buf)
     q = &i;
   p = &buf;
   if (p->data[1] == 1)
-    p->data[0] = *q; /* { dg-bogus "use of NULL 'q'" "" { xfail *-*-* } } */
+    p->data[0] = *q; /* { dg-bogus "use of NULL 'q'" } */
   return;
 }
+
+/* To avoid a false positive read-through-uninit at *q, we need to handle
+   phi nodes, and to enforce constraints.
+
+   region_model's constraint model is now good enough to rule out
+   the path as infeasible.
+
+   Looks like at the first:
+
+     if (buf.data[1] == 1)
+
+   we have an unknown value for buf.data[1], but it's the unknown
+   value for "buf" as a whole; we should have created unknown values
+   for the child (or for accesses to the parent unknown value).  */
+
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
index 7583a1c..8da8a48 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
@@ -374,7 +374,11 @@ void test_20 (int i, int j)
   /* { dg-warning "TRUE" "" { target *-*-* } .-2 } */
   // TODO(xfail): ^^^ this implicitly generates control flow edges
 
-  __analyzer_eval (i || 0); /* { dg-warning "UNKNOWN" } */
+  __analyzer_eval (i || 0); /* { dg-warning "UNKNOWN" "" { xfail *-*-* } } */
+  /* { dg-warning "FALSE" "" { target *-*-* } .-1 } */
+  /* { dg-warning "TRUE" "" { target *-*-* } .-2 } */
+  // TODO(xfail): ^^^ this implicitly generates control flow edges
+
   __analyzer_eval (i || 1); /* { dg-warning "TRUE" } */
   __analyzer_eval (i || j); /* { dg-warning "UNKNOWN" "" { xfail *-*-* } } */
   /* { dg-warning "FALSE" "" { target *-*-* } .-1 } */
@@ -383,7 +387,10 @@ void test_20 (int i, int j)
 
   __analyzer_eval (~i); /* { dg-warning "UNKNOWN" } */
   __analyzer_eval (-i); /* { dg-warning "UNKNOWN" } */
-  __analyzer_eval (+i); /* { dg-warning "UNKNOWN" } */
+  __analyzer_eval (+i); /* { dg-warning "UNKNOWN" "" { xfail *-*-* } } */
+  /* { dg-warning "FALSE" "" { target *-*-* } .-1 } */
+  /* { dg-warning "TRUE" "" { target *-*-* } .-2 } */
+  // TODO(xfail): ^^^ we already have control flow edges above, I believe
 
   /* TODO:
      - division by zero
@@ -604,6 +611,7 @@ void test_30 (void *ptr)
   p->x = 42;
 
   __analyzer_eval (p->x == 42); /* { dg-warning "TRUE" } */
+  __analyzer_eval (q->x == 42); /* { dg-warning "TRUE" } */
 }
 
 void test_31 (unsigned i)
-- 
1.8.5.3

