From 938fb8df68f080c38b8824cdbbe5793e82ade1f5 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Wed, 14 Aug 2019 10:28:38 -0400
Subject: [PATCH 73/96] FIXME: add notes to stmt_requires_new_enode_p

---
 gcc/analyzer/impl-4.cc | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/gcc/analyzer/impl-4.cc b/gcc/analyzer/impl-4.cc
index 12e2504..8ddbdf1 100644
--- a/gcc/analyzer/impl-4.cc
+++ b/gcc/analyzer/impl-4.cc
@@ -6335,8 +6335,80 @@ stmt_requires_new_enode_p (const gimple *stmt)
      ...which seems wrong, presumably it ought to be at the
      call to malloc, not the return.  */
   // FIXME: Do we really want to split after the previous statement, instead?
+  /*  We have:
+
+     bb:
+       _4 = malloc (...);
+
+     bb:
+       L0:
+       return _4;
+
+     and hence a new supernode.
+
+     In both cases, we get an enode for the after-snode with a state change
+     to "unchecked" immediately after the malloc.
+     We then have:
+     - enode for before-snode
+     - enode for before-stmt for L0
+     - (optionally) enode for before-stmt for the return _4;
+     - enode for after-snode
+
+    With a break, we have:
+
+      path[0]: EK_FUNCTION_ENTRY "entry to ‘make_boxed_int’" (depth 0, m_loc=22155405)
+      path[1]: EK_START_CFG_EDGE "" (depth 0, m_loc=0)
+      path[2]: EK_END_CFG_EDGE "...to here" (depth 0, m_loc=2147483893)
+      path[3]: EK_STMT "stmt: result_3 = wrapped_malloc (4);" (depth 0, m_loc=2147483893)
+      path[4]: EK_CALL_EDGE "calling ‘wrapped_malloc’ from ‘make_boxed_int’" (depth 0, m_loc=2147483893)
+      path[5]: EK_FUNCTION_ENTRY "entry to ‘wrapped_malloc’" (depth 1, m_loc=22110541)
+      path[6]: EK_START_CFG_EDGE "" (depth 1, m_loc=0)
+      path[7]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=2147483892)
+      path[8]: EK_STMT "stmt: _4 = malloc (size_2(D));" (depth 1, m_loc=2147483892)
+      path[9]: EK_STATE_CHANGE "state of ‘<unknown>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=2147483892)
+      path[10]: EK_START_CFG_EDGE "" (depth 1, m_loc=2147483892)
+      path[11]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=2147483892)
+      path[12]: EK_STMT "stmt: <L0>:" (depth 1, m_loc=0)
+      path[13]: EK_STMT "stmt: return _4;" (depth 1, m_loc=2147483892)
+      path[14]: EK_STATE_CHANGE "state of ‘<return-value>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=2147483892)
+      path[15]: EK_START_CFG_EDGE "" (depth 1, m_loc=2147483892)
+      path[16]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=22122624)
+      path[17]: EK_RETURN_EDGE "returning to ‘make_boxed_int’ from ‘wrapped_malloc’" (depth 0, m_loc=2147483893)
+      path[18]: EK_STMT "stmt: result_3->i = i_4(D);" (depth 0, m_loc=2147483894)
+and in particular:
+      path[14]: EK_STATE_CHANGE "state of ‘<return-value>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=2147483892)
+
+Without a break, we have:
+      path[0]: EK_FUNCTION_ENTRY "entry to ‘make_boxed_int’" (depth 0, m_loc=22155405)
+      path[1]: EK_START_CFG_EDGE "" (depth 0, m_loc=0)
+      path[2]: EK_END_CFG_EDGE "...to here" (depth 0, m_loc=2147483893)
+      path[3]: EK_STMT "stmt: result_3 = wrapped_malloc (4);" (depth 0, m_loc=2147483893)
+      path[4]: EK_CALL_EDGE "calling ‘wrapped_malloc’ from ‘make_boxed_int’" (depth 0, m_loc=2147483893)
+      path[5]: EK_FUNCTION_ENTRY "entry to ‘wrapped_malloc’" (depth 1, m_loc=22110541)
+      path[6]: EK_START_CFG_EDGE "" (depth 1, m_loc=0)
+      path[7]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=2147483892)
+      path[8]: EK_STMT "stmt: _4 = malloc (size_2(D));" (depth 1, m_loc=2147483892)
+      path[9]: EK_STATE_CHANGE "state of ‘<unknown>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=2147483892)
+      path[10]: EK_START_CFG_EDGE "" (depth 1, m_loc=2147483892)
+      path[11]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=2147483892)
+      path[12]: EK_STMT "stmt: <L0>:" (depth 1, m_loc=0)
+      path[13]: EK_STATE_CHANGE "state of ‘<return-value>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=0)
+      path[14]: EK_START_CFG_EDGE "" (depth 1, m_loc=2147483892)
+      path[15]: EK_END_CFG_EDGE "...to here" (depth 1, m_loc=22122624)
+      path[16]: EK_RETURN_EDGE "returning to ‘make_boxed_int’ from ‘wrapped_malloc’" (depth 0, m_loc=2147483893)
+      path[17]: EK_STMT "stmt: result_3->i = i_4(D);" (depth 0, m_loc=2147483894)
+
+and note how event 13 has an unknown location:
+      path[13]: EK_STATE_CHANGE "state of ‘<return-value>’: ‘start’ -> ‘unchecked’ (origin: NULL)" (depth 1, m_loc=0)
+
+      I think what we're running into here is that state_change events can be
+      added based on region-model changes, not just sm-state changes, and we
+      want to split enodes at the points where the events would be emitted.
+  */
+#if 0
   if (gimple_code (stmt) == GIMPLE_RETURN)
     return true;
+#endif
 
   return false;
 }
-- 
1.8.5.3

