[analyzer] DynamicSize: Simplify the assumption creating of sizes

[Charusso]

Summary

-

[Charusso]

@NoQ, I hope this is what you have suggested.

[Charusso]

I think we do not need to create assumptions. However, there is a tiny difference which continues in D69726

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h

 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 
 namespace clang {
 namespace ento {
 
-/// Get the stored dynamic size for the region \p MR.
+/// \returns The stored dynamic size for the region \p MR.
 DefinedOrUnknownSVal getDynamicSize(ProgramStateRef State, const MemRegion *MR,
                                     SValBuilder &SVB);
 
-/// Get the stored element count of the region \p MR.
+/// \returns The stored element count of the region \p MR.
 DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State,
                                             const MemRegion *MR,
                                             SValBuilder &SVB,
                                             QualType ElementTy);
 
+/// Set the dynamic size \p Size of the region \p MR.
+/// \returns The assumption of the current dynamic size equal to \p Size.
+ProgramStateRef setDynamicSizeAssumption(ProgramStateRef State,
+                                         const MemRegion *MR, SValBuilder &SVB,
+                                         DefinedOrUnknownSVal Size);
+
+/// Set the dynamic size \p Size of the region \p MR.
+/// \returns The dual assumption of the current dynamic size equal to \p Size.
+std::pair<ProgramStateRef, ProgramStateRef>
+setDynamicSizeDualAssumption(ProgramStateRef State, const MemRegion *MR,
+                             SValBuilder &SVB, DefinedOrUnknownSVal Size);
+
 } // namespace ento
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_DYNAMICSIZE_H

clang/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp

case Builtin::BI__builtin_alloca: {
     // Set the extent of the region in bytes. This enables us to use the
     // SVal of the argument directly. If we save the extent in bits, we
     // cannot represent values like symbol*8.
     auto Size = Call.getArgSVal(0);
     if (Size.isUndef())
       return true; // Return true to model purity.
 
     SValBuilder& svalBuilder = C.getSValBuilder();
-    DefinedOrUnknownSVal DynSize = getDynamicSize(state, R, svalBuilder);
-    DefinedOrUnknownSVal DynSizeMatchesSizeArg =
-        svalBuilder.evalEQ(state, DynSize, Size.castAs<DefinedOrUnknownSVal>());
-    state = state->assume(DynSizeMatchesSizeArg, true);
+    state = setDynamicSizeAssumption(state, R, svalBuilder,
+                                     Size.castAs<DefinedOrUnknownSVal>());
     assert(state && "The region should not have any previous constraints");
 
     C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
     return true;
   }
 
   case Builtin::BI__builtin_dynamic_object_size:
   case Builtin::BI__builtin_object_size:

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

bool CStringChecker::memsetAux(const Expr *DstBuffer, SVal CharVal,
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   ASTContext &Ctx = C.getASTContext();
 
   // void *memset(void *dest, int ch, size_t count);
   // For now we can only handle the case of offset is 0 and concrete char value.
   if (Offset.isValid() && !Offset.hasSymbolicOffset() &&
       Offset.getOffset() == 0) {
-    // Get the base region's size.
-    DefinedOrUnknownSVal SizeDV = getDynamicSize(State, BR, svalBuilder);
-
     ProgramStateRef StateWholeReg, StateNotWholeReg;
     std::tie(StateWholeReg, StateNotWholeReg) =
-        State->assume(svalBuilder.evalEQ(State, SizeDV, *SizeNL));
+        setDynamicSizeDualAssumption(State, BR, svalBuilder, *SizeNL);
 
     // With the semantic of 'memset()', we should convert the CharVal to
     // unsigned char.
     CharVal = svalBuilder.evalCast(CharVal, Ctx.UnsignedCharTy, Ctx.IntTy);
 
     ProgramStateRef StateNullChar, StateNonNullChar;
     std::tie(StateNullChar, StateNonNullChar) =
         assumeZero(C, State, CharVal, Ctx.UnsignedCharTy);

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

ProgramStateRef MallocChecker::addExtentSize(CheckerContext &C,
   }
 
   // Set the region's extent equal to the Size in Bytes.
   QualType ElementType = NE->getAllocatedType();
   ASTContext &AstContext = C.getASTContext();
   CharUnits TypeSize = AstContext.getTypeSizeInChars(ElementType);
 
   if (ElementCount.getAs<NonLoc>()) {
-    DefinedOrUnknownSVal DynSize = getDynamicSize(State, Region, svalBuilder);
-
     // size in Bytes = ElementCount*TypeSize
     SVal SizeInBytes = svalBuilder.evalBinOpNN(
         State, BO_Mul, ElementCount.castAs<NonLoc>(),
         svalBuilder.makeArrayIndex(TypeSize.getQuantity()),
         svalBuilder.getArrayIndexType());
-    DefinedOrUnknownSVal DynSizeMatchesSize = svalBuilder.evalEQ(
-        State, DynSize, SizeInBytes.castAs<DefinedOrUnknownSVal>());
-    State = State->assume(DynSizeMatchesSize, true);
+
+    State = setDynamicSizeAssumption(
+        State, Region, svalBuilder, SizeInBytes.castAs<DefinedOrUnknownSVal>());
   }
   return State;
 }
 
 void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
                                  CheckerContext &C) const {
 
   if (!ChecksEnabled[CK_NewDeleteChecker])
ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
 
   // Set the region's extent equal to the Size parameter.
   const SymbolicRegion *R =
       dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion());
   if (!R)
     return nullptr;
   if (Optional<DefinedOrUnknownSVal> DefinedSize =
           Size.getAs<DefinedOrUnknownSVal>()) {
-    DefinedOrUnknownSVal DynSize = getDynamicSize(State, R, svalBuilder);
-
-    DefinedOrUnknownSVal DynSizeMatchesSize =
-        svalBuilder.evalEQ(State, DynSize, *DefinedSize);
-
-    State = State->assume(DynSizeMatchesSize, true);
-    assert(State);
+    State = setDynamicSizeAssumption(State, R, svalBuilder, *DefinedSize);
   }
 
   return MallocUpdateRefState(C, CE, State, Family);
 }
 
 static ProgramStateRef MallocUpdateRefState(CheckerContext &C, const Expr *E,
                                             ProgramStateRef State,
                                             AllocationFamily Family,

clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   SVal EleSizeVal = svalBuilder.makeIntVal(EleSize.getQuantity(), SizeTy);
 
   // Multiply the array length by the element size.
   SVal ArraySizeVal = svalBuilder.evalBinOpNN(
       state, BO_Mul, ArrayLength, EleSizeVal.castAs<NonLoc>(), SizeTy);
 
   // Finally, assume that the array's size matches the given size.
   const LocationContext *LC = C.getLocationContext();
-  DefinedOrUnknownSVal DynSize =
-      getDynamicSize(state, state->getRegion(VD, LC), svalBuilder);
-
-  DefinedOrUnknownSVal ArraySize = ArraySizeVal.castAs<DefinedOrUnknownSVal>();
-  DefinedOrUnknownSVal sizeIsKnown =
-      svalBuilder.evalEQ(state, DynSize, ArraySize);
-  state = state->assume(sizeIsKnown, true);
+  state = setDynamicSizeAssumption(state, state->getRegion(VD, LC), svalBuilder,
+                                   ArraySizeVal.castAs<DefinedOrUnknownSVal>());
 
   // Assume should not fail at this point.
   assert(state);
 
   // Remember our assumptions!
   C.addTransition(state);
 }
 
 void ento::registerVLASizeChecker(CheckerManager &mgr) {
   mgr.registerChecker<VLASizeChecker>();
 }
 
 bool ento::shouldRegisterVLASizeChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Core/DynamicSize.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicSize.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
 
+REGISTER_MAP_WITH_PROGRAMSTATE(DynamicSizeMap, const clang::ento::MemRegion *,
+                               clang::ento::DefinedOrUnknownSVal)
+
 namespace clang {
 namespace ento {
 
 DefinedOrUnknownSVal getDynamicSize(ProgramStateRef State, const MemRegion *MR,
                                     SValBuilder &SVB) {
+  if (const DefinedOrUnknownSVal *Size = State->get<DynamicSizeMap>(MR))
+    return *Size;
+
   return MR->getMemRegionManager().getStaticSize(MR, SVB);
 }
 
 DefinedOrUnknownSVal getDynamicElementCount(ProgramStateRef State,
                                             const MemRegion *MR,
                                             SValBuilder &SVB,
                                             QualType ElementTy) {
   MemRegionManager &MemMgr = MR->getMemRegionManager();
   ASTContext &Ctx = MemMgr.getContext();
 
   DefinedOrUnknownSVal Size = getDynamicSize(State, MR, SVB);
   const llvm::APSInt *SizeInt = SVB.getKnownValue(State, Size);
   if (!SizeInt)
     return UnknownVal();
 
   CharUnits RegionSize = CharUnits::fromQuantity(SizeInt->getSExtValue());
   CharUnits ElementSize = Ctx.getTypeSizeInChars(ElementTy);
 
   // If a variable is reinterpreted as a type that doesn't fit into a larger
   // type evenly, round it down.
   // This is a signed value, since it's used in arithmetic with signed indices.
   return SVB.makeIntVal(RegionSize / ElementSize, SVB.getArrayIndexType());
 }
 
+ProgramStateRef setDynamicSizeAssumption(ProgramStateRef State,
+                                         const MemRegion *MR, SValBuilder &SVB,
+                                         DefinedOrUnknownSVal Size) {
+  DefinedOrUnknownSVal DynSize = getDynamicSize(State, MR, SVB);
+
+  if ((State = State->assume(SVB.evalEQ(State, DynSize, Size), true)))
+    State = State->set<DynamicSizeMap>(MR, Size);
+
+  return State;
+}
+
+std::pair<ProgramStateRef, ProgramStateRef>
+setDynamicSizeDualAssumption(ProgramStateRef State, const MemRegion *MR,
+                             SValBuilder &SVB, DefinedOrUnknownSVal Size) {
+  DefinedOrUnknownSVal DynSize = getDynamicSize(State, MR, SVB);
+
+  ProgramStateRef StateEQ, StateNE;
+  std::tie(StateEQ, StateNE) = State->assume(SVB.evalEQ(State, DynSize, Size));
+
+  if (StateEQ)
+    StateEQ = StateEQ->set<DynamicSizeMap>(MR, Size);
+
+  return {StateEQ, StateNE};
+}
+
 } // namespace ento
 } // namespace clang