[analyzer] Make isSubRegionOf reflexive

[george.karpenkov]

Summary

All usages of isSubRegionOf separately check for reflexive case, and in any case, set theory tells us that each set is a subset of itself.

[NoQ]

Yeah, i guess we thought that only SubRegion shall ever be a sub-region. But in fact we have too much inheritance-for-code-reuse in MemRegion hierarchy for those abstract classes to have any deep meaning.

lib/StaticAnalyzer/Core/MemRegion.cpp

106–107

Change this to do..while to avoid the initial check?

include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

public:
 
   virtual MemRegionManager* getMemRegionManager() const = 0;
 
   const MemSpaceRegion *getMemorySpace() const;
 
   const MemRegion *getBaseRegion() const;
 
   /// Check if the region is a subregion of the given region.
+  /// Each region is a subregion of itself.
   virtual bool isSubRegionOf(const MemRegion *R) const;
 
   const MemRegion *StripCasts(bool StripBaseCasts = true) const;
 
   /// \brief If this is a symbolic region, returns the region. Otherwise,
   /// goes up the base chain looking for the first symbolic base region.
   const SymbolicRegion *getSymbolicBase() const;
 

lib/StaticAnalyzer/Checkers/MisusedMovedObjectChecker.cpp

 
 REGISTER_MAP_WITH_PROGRAMSTATE(TrackedRegionMap, const MemRegion *, RegionState)
 
 // If a region is removed all of the subregions needs to be removed too.
 static ProgramStateRef removeFromState(ProgramStateRef State,
                                        const MemRegion *Region) {
   if (!Region)
     return State;
-  // Note: The isSubRegionOf function is not reflexive.
-  State = State->remove<TrackedRegionMap>(Region);
   for (auto &E : State->get<TrackedRegionMap>()) {
     if (E.first->isSubRegionOf(Region))
       State = State->remove<TrackedRegionMap>(E.first);
   }
   return State;
 }
 
 static bool isAnyBaseRegionReported(ProgramStateRef State,

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

UndefOrNullArgVisitor::VisitNode(const ExplodedNode *N,
   unsigned Idx = 0;
   ArrayRef<ParmVarDecl*> parms = Call->parameters();
 
   for (ArrayRef<ParmVarDecl*>::iterator I = parms.begin(), E = parms.end();
                               I != E; ++I, ++Idx) {
     const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion();
 
     // Are we tracking the argument or its subregion?
-    if ( !ArgReg || (ArgReg != R && !R->isSubRegionOf(ArgReg->StripCasts())))
+    if ( !ArgReg || !R->isSubRegionOf(ArgReg->StripCasts()))
       continue;
 
     // Check the function parameter type.
     const ParmVarDecl *ParamDecl = *I;
     assert(ParamDecl && "Formal parameter has no decl?");
     QualType T = ParamDecl->getType();
 
     if (!(T->isAnyPointerType() || T->isReferenceType())) {

lib/StaticAnalyzer/Core/MemRegion.cpp

MemRegionManager::~MemRegionManager() {
   // their destructors.
 }
 
 //===----------------------------------------------------------------------===//
 // Basic methods.
 //===----------------------------------------------------------------------===//
 
 bool SubRegion::isSubRegionOf(const MemRegion* R) const {
-  const MemRegion* r = getSuperRegion();
-  while (r != nullptr) {
+  const MemRegion* r = this;
+  do {
     if (r == R)
       return true;
     if (const SubRegion* sr = dyn_cast<SubRegion>(r))
       r = sr->getSuperRegion();
     else
       break;
-  }
+  } while (r != nullptr);
   return false;
 }
 
 MemRegionManager* SubRegion::getMemRegionManager() const {
   const SubRegion* r = this;
   do {
     const MemRegion *superRegion = r->getSuperRegion();
     if (const SubRegion *sr = dyn_cast<SubRegion>(superRegion)) {

lib/StaticAnalyzer/Core/ProgramState.cpp

if (const SymbolDerived *SD = dyn_cast<SymbolDerived>(*SI)) {
       if (const TaintedSubRegions *Regs =
               get<DerivedSymTaint>(SD->getParentSymbol())) {
         const TypedValueRegion *R = SD->getRegion();
         for (auto I : *Regs) {
           // FIXME: The logic to identify tainted regions could be more
           // complete. For example, this would not currently identify
           // overlapping fields in a union as tainted. To identify this we can
           // check for overlapping/nested byte offsets.
-          if (Kind == I.second &&
-              (R == I.first || R->isSubRegionOf(I.first)))
+          if (Kind == I.second && R->isSubRegionOf(I.first))
             return true;
         }
       }
     }
 
     // If memory region is tainted, data is also tainted.
     if (const SymbolRegionValue *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
       if (isTainted(SRV->getRegion(), Kind))

lib/StaticAnalyzer/Core/RegionStore.cpp

if (NextKey.getRegion() == TopKey.getRegion()) {
         // FIXME: This is probably incorrect; consider invalidating an outer
         // struct whose first field is bound to a LazyCompoundVal.
         if (IncludeAllDefaultBindings || NextKey.isDirect())
           Bindings.push_back(*I);
       }
 
     } else if (NextKey.hasSymbolicOffset()) {
       const MemRegion *Base = NextKey.getConcreteOffsetRegion();
-      if (Top->isSubRegionOf(Base)) {
+      if (Top->isSubRegionOf(Base) && Top != Base) {
         // Case 3: The next key is symbolic and we just changed something within
         // its concrete region. We don't know if the binding is still valid, so
         // we'll be conservative and include it.
         if (IncludeAllDefaultBindings || NextKey.isDirect())
           if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
             Bindings.push_back(*I);
       } else if (const SubRegion *BaseSR = dyn_cast<SubRegion>(Base)) {
         // Case 4: The next key is symbolic, but we changed a known
         // super-region. In this case the binding is certainly included.
-        if (Top == Base || BaseSR->isSubRegionOf(Top))
+        if (BaseSR->isSubRegionOf(Top))
           if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
             Bindings.push_back(*I);
       }
     }
   }
 }
 
 static void