This is an archive of the discontinued LLVM Phabricator instance.

[analyzer] Model correct dispatch_once() 'done' value in BodyFarm
ClosedPublic

Authored by dcoughlin on Nov 6 2017, 11:22 AM.

Details

Summary

The analyzer's BodyFarm models dispatch_once() by comparing the passed-in predicate against a known 'done' value. If the predicate does not have that value, the model updates the predicate to have that value and executes the passed in block.

Unfortunately, the current model uses the wrong 'done' value: 1 instead of ~0. This interferes with libdispatch's static inline function _dispatch_once(), which enables a fast path if the block has already been executed. That function uses builtin_assume() to tell the compiler that the done flag is set to ~0 on exit. When r302880 added modeling of builtin_assume(), this caused the analyzer to assume 1 == ~0, which in turn caused the analyzer to never explore any code after a call to dispatch_once().

This patch regains the missing coverage by updating BodyFarm to use the correct 'done' value.

rdar://problem/34413048

Diff Detail

Repository
rL LLVM

Event Timeline

dcoughlin created this revision.Nov 6 2017, 11:22 AM
george.karpenkov accepted this revision.Nov 6 2017, 11:27 AM

Looks good to me.
I really don't think the test format chosen in unix-fns.c is a good idea, as it is very large, auto-generated, and tightly coupled to chosen formatting. I think combination of checking for warning with clang_analyzer_eval will be much better, but then maybe it's not a job for this patch.

This revision is now accepted and ready to land.Nov 6 2017, 11:27 AM

Yeah, I'm not a fan of this style of testing for path diagnostics, either.

This revision was automatically updated to reflect the committed changes.