[analyzer][docs] Add CSA release notes

[steakhal]

Summary

We'll soon branch off, and start releasing clang-17.
Here is a patch, adjusting the release notes for what we achieved since
the last release.

I used this command to inspect the interesting commits:

git log --oneline llvmorg-16.0.0..llvm/main \
  clang/{lib/StaticAnalyzer,include/clang/StaticAnalyzer} | \
  grep -v NFC | grep -v -i revert

This filters in CSA directories and filters out NFC and revert commits.

Given that in the release-notes, we usually don't put links to commits,
I'll remove them from this patch as well. I just put them there to make
it easier to review for you.

I tried to group the changes into meaningful chunks, and dropped some of
the uninteresting commits.
I've also dropped the commits that were backported to clang-16.

Check out how it looks, and propose changes like usual.

---

Here is a preview of how the CSA section looks with this:

ReleaseNotes.html95 KBDownload

---

FYI the ninja docs-clang-html produces the html docs, including the ReleaseNotes.
And the produced artifact will be at build/tools/clang/docs/html/ReleaseNotes.html.

[xazax.hun]

clang/docs/ReleaseNotes.rst

1013

I think we should mention something like "Use -fstrict-flex-array=<N> instead if necessary."

1014

I think we usually do not mention crash fixes in the changelog. We have them in almost every release and sometimes there are quite a few of them.

[steakhal]

clang/docs/ReleaseNotes.rst

1013

Good point.

1014

I won't mention the explicit commit where it was fixed.
However, downstream users might wanna know about crashes and fixes that happened in this release.
And speaking about past practices about release notes, I think we can improve on that TBH.
We can move it down on the list if you want, but I'd rather keep it.

[xazax.hun]

clang/docs/ReleaseNotes.rst

1014

Is this the only crash fix we had? Moving crash fixes to the bottom of the list sounds good to me.

[OikawaKirie]

The key idea of my commit 1bd2d335b649:

• For string APIs that will not provide the copy length (strcpy), we will use the buffer decl and literal length to infer whether it overflows. If the copy operation does not overflow, we will now only invalidate the buffer string being copied to.
• For string APIs that never overflow (strsep), we will always invalidate the target buffer only.
• For those that we cannot correctly handle now (std::copy), we will also invalidate the base region and make all pointers in the base region escape.

Hence,
For strcpys, we infer through buffer size and string literals.
For strsep, we believe it never overflows through its functionality specification. It is also an inference.

Whereas for memcpy where the copy length is given in arguments, the non-inferring circumstances, it was implemented previously in patch D12571, not a part of my changes.

clang/docs/ReleaseNotes.rst

1026–1028

One tiny change to the abstraction.
The `CStringChecker` will invalidate less if the copy operation is inferable to be bounded.

[steakhal]

Currentl look:

let me know if you like it.
Feel free to propose changes.

I'm not sure about the relative ordering. We should consider some semantic ordering. Such as perceived impact on the regular user?

IMO the taint tracking and the ArrayBoundCheckerV2 improvements were quite impactful, as both of those were up on the table for a really long time now.
Also, for a similar reason, I think Objective-C improvements definitely deserve the spotlight.

---

@balazske @donat.nagy WDYT about the StreamChecker and the StdCLibraryFunctions entries? I didn't follow those patches, thus I cannot write the notes for it either.

[OikawaKirie]

LGTM for my part. Thx.

Since I am not very familiar with other changes, I have no detailed suggestions for the order.

clang/docs/ReleaseNotes.rst

1026–1027

The lengths of both src and dst buffers need to be known.

1041

I think this may be a typo here, as we do not invalidate the source buffer originally.

[steakhal]

In D155445#4508728, @OikawaKirie wrote:

LGTM for my part. Thx.

Since I am not very familiar with other changes, I have no detailed suggestions for the order.

Thanks for the feedback. Applied!

clang/docs/ReleaseNotes.rst

1014

No, it wasn't. We also had one for init-expr global variable initializers. See
I swept that fix under the carpet of "Fixed some bugs around the handling of constant global arrays and their initializer expressions". I made it more explicit now.

However, at this point, I think it's okay to simply omit the mention of the null deref crash fix.
Second thoughts?

1026–1027

Applied!

1026–1028

I decided to elaborate on this a bit. Let me know if it's too thorough now.

1041

Exactly. Thanks!

[xazax.hun]

clang/docs/ReleaseNotes.rst

1014

I have no strong preference, I am fine with both :)

[balazske]

clang/docs/ReleaseNotes.rst

1068

The checker checks for much more functions in POSIX mode.
These additional commits:
6dccf5b8d550911f06e492a3a75c640c05efdab3
f12808ab20369c85ddb602e5a78bab40d16bb83f
39670ae3b93470b2d29fe78e6d40c5d82a05e4a1

[steakhal]

After removing all commit refs, here is how it looks:

clang/docs/ReleaseNotes.rst

- Added check in ``clang_getFieldDeclBitWidth`` for whether a bit-field
   has an evaluable bit width. Fixes undefined behavior when called on a
   bit-field whose width depends on a template parameter.
 
 - Added ``CXBinaryOperatorKind`` and ``CXUnaryOperatorKind``.
   (`#29138 <https://github.com/llvm/llvm-project/issues/29138>`_)
 
 Static Analyzer
 ---------------
+
 - Fix incorrect alignment attribute on the this parameter of certain
   non-complete destructors when using the Microsoft ABI.
   (`#60465 <https://github.com/llvm/llvm-project/issues/60465>`_)
 
+- Removed the deprecated
+  ``consider-single-element-arrays-as-flexible-array-members`` analyzer option.
+  Any use of this flag will result in an error.
+  Use `-fstrict-flex-arrays=<n>
+  <https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-fstrict-flex-arrays>`_
+
+- Better modeling of lifetime-extended memory regions. As a result, the
+  ``MoveChecker`` raises more true-positive reports.
+
+- Fixed some bugs (including crashes) around the handling of constant global
+  arrays and their initializer expressions.
+
+- The ``CStringChecker`` will invalidate less if the copy operation is
+  inferable to be bounded. For example, if the arguments of ``strcpy`` are
+  known to be of certain lengths and that are in-bounds.
+
+   .. code-block:: c++
+
+    struct {
+      void *ptr;
+      char arr[4];
+    } x;
+    x.ptr = malloc(1);
+    // extent of 'arr' is 4, and writing "hi\n" (4 characters),
+    // thus no buffer overflow can happen
+    strcpy(x.arr, "hi\n");
+    free(x.ptr); // no longer reports memory leak here
+
+  Similarly, functions like ``strsep`` now won't invalidate the object
+  containing the destination buffer, because it can never overflow.
+  Note that, ``std::copy`` is still not modeled, and as such, it will still
+  invalidate the enclosing object on call.
+  (`#55019 <https://github.com/llvm/llvm-project/issues/55019>`_)
+
+- Implement ``BufferOverlap`` check for ``sprint``/``snprintf``
+  The ``CStringChecker`` checks for buffer overlaps for ``sprintf`` and
+  ``snprintf``.
+
+- Objective-C support was improved around checking ``_Nonnull`` and
+  ``_Nullable`` including block pointers and literal objects.
+
+- Let the ``StreamChecker`` detect ``NULL`` streams instead of by
+  ``StdCLibraryFunctions``.
+  ``StreamChecker`` improved on the ``fseek`` modeling for the ``SEEK_SET``,
+  ``SEEK_END``, ``SEEK_CUR`` arguments.
+
+- ``StdCLibraryFunctionArgs`` was merged into the ``StdCLibraryFunctions``.
+  The diagnostics of the ``StdCLibraryFunctions`` was improved.
+
+- ``QTimer::singleShot`` now doesn't raise false-positives for memory leaks by
+  the ``MallocChecker``.
+  (`#39713 <https://github.com/llvm/llvm-project/issues/39713>`_)
+
+- Fixed the infamous unsigned index false-positives in the
+  ``ArrayBoundCheckerV2`` checker.
+  (`#44493 <https://github.com/llvm/llvm-project/issues/44493>`_)
+
+- Now, taint propagations are tracked further back until the real taint source.
+  This improves all taint-related diagnostics.
+
+- Fixed a null-pointer dereference crash inside the ``MoveChecker``.
+
 .. _release-notes-sanitizers:
 
 Sanitizers
 ----------
 
 Python Binding Changes
 ----------------------
 The following methods have been added: