rnkovacs (Reka Kovacs)
User

Projects

User does not belong to any projects.

User Details

User Since
Apr 30 2017, 3:27 AM (76 w, 6 d)

Recent Activity

Wed, Oct 10

rnkovacs added inline comments to D53069: [analyzer][www] Update avaible_checks.html.
Wed, Oct 10, 4:40 AM

Aug 28 2018

rnkovacs added a comment to D51385: [analyzer] InnerPointerChecker: Fix a segfault..

Return value of dyn_cast_or_null should be checked before use. Otherwise we may put a null pointer into the map as a key and eventually crash in checkDeadSymbols.

Aug 28 2018, 3:53 PM

Aug 21 2018

rnkovacs accepted D48027: [analyzer] Improve `CallDescription` to handle c++ method..
In D48027#1203944, @MTC wrote:

However this approach has limit. Given the code below, we cannot distinguish whether the basic_string is user-defined struct or namespace. That's means when the user provide {"std", "basic_string", "append"}, we can only know the qualified name of the call sequentially contains std, basic_string, append. We don't know if these names come from RecordDecl or NamespaceDecl.

namespace  std {
  namespace basic_string {
    struct A {
      void append() {}
    };
  }
}

void foo() {
  std::basic_string::A a;
  a.append(); // Match
}

@rnkovacs What do you think? Can this approach meet InnerPointerChecker's needs?

Aug 21 2018, 8:58 AM

Aug 10 2018

rnkovacs retitled D49570: [analyzer] Improve warning messages and notes of InnerPointerChecker from [analyzer] Improve warning messages and notes of DanglingInternalBufferChecker to [analyzer] Improve warning messages and notes of InnerPointerChecker.
Aug 10 2018, 3:51 PM
rnkovacs added inline comments to D49570: [analyzer] Improve warning messages and notes of InnerPointerChecker.
Aug 10 2018, 3:47 PM
rnkovacs updated the diff for D49570: [analyzer] Improve warning messages and notes of InnerPointerChecker.

Address comments & rebase.

Aug 10 2018, 3:46 PM

Aug 6 2018

rnkovacs added a comment to D50211: [analyzer] Fix displayed checker name for InnerPointerChecker.
In D50211#1190146, @NoQ wrote:

Welcome to the club!

Aug 6 2018, 3:23 PM
rnkovacs closed D50211: [analyzer] Fix displayed checker name for InnerPointerChecker.

Committed in r339067, I just messed up the revision-closing line in the commit message.

Aug 6 2018, 3:19 PM

Aug 5 2018

rnkovacs updated the diff for D50211: [analyzer] Fix displayed checker name for InnerPointerChecker.

Replace empty Optionals with Nones.

Aug 5 2018, 11:12 PM

Aug 3 2018

rnkovacs added a comment to D50211: [analyzer] Fix displayed checker name for InnerPointerChecker.
In D50211#1186630, @NoQ wrote:

I see, so that's how it's done!

I also noticed that checker name was weird in exploded graph dumps, i.e. it was showing regular new/delete stuff as if it was done by InnerPointer checker. I'll check if this is fixed tomorrow.

Aug 3 2018, 3:46 PM

Aug 2 2018

rnkovacs created D50211: [analyzer] Fix displayed checker name for InnerPointerChecker.
Aug 2 2018, 6:39 PM

Aug 1 2018

rnkovacs updated the diff for D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker.

Add helper function to be used in both callbacks.

Aug 1 2018, 8:04 PM
rnkovacs updated the diff for D49811: [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.
In D49811#1175726, @NoQ wrote:

I guess you could write a test with debug.AnalysisOrder (by making its checkEndFunction callback (that you'll have to define) print different things depending on the return statement), not sure if it's worth it; you can also merge this commit with D49361 instead.

Aug 1 2018, 7:57 PM

Jul 30 2018

rnkovacs updated the diff for D49058: [analyzer] Move InnerPointerChecker out of alpha.

Rebase.

Jul 30 2018, 9:49 AM
rnkovacs updated the diff for D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker.

De-duplicate & add comment.

Jul 30 2018, 8:09 AM

Jul 27 2018

rnkovacs added inline comments to D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 27 2018, 5:04 PM
rnkovacs updated the diff for D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 27 2018, 5:04 PM

Jul 25 2018

rnkovacs updated the diff for D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker.

Updated to use the extended checkEndFunction() callback (committed in rL337215 - I forgot to add it as a dependency).

Jul 25 2018, 3:05 PM
rnkovacs added a comment to D49811: [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.

I'm not sure how to test this.
I'll need it in D49361 when I update it to use the changed checkEndFunction() callback, and that will kind of test this too.

Jul 25 2018, 12:49 PM
rnkovacs added a dependency for D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker: D49811: [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.
Jul 25 2018, 12:24 PM
rnkovacs added a dependent revision for D49811: [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor: D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker.
Jul 25 2018, 12:24 PM
rnkovacs created D49811: [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.
Jul 25 2018, 11:38 AM
rnkovacs added inline comments to D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 25 2018, 9:13 AM
rnkovacs updated the diff for D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.

Tiny bit more re-structuring.

Jul 25 2018, 9:13 AM
rnkovacs added inline comments to D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 25 2018, 8:25 AM
rnkovacs updated the diff for D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.

Fix note for function pointers & handle argument counting in member operator calls.
I also refactored the code a little, because after moving things from checkPreCall to checkPostCall, the structure was a bit confusing.

Jul 25 2018, 8:22 AM

Jul 23 2018

rnkovacs added inline comments to D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 23 2018, 5:30 PM
rnkovacs updated the diff for D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.

Addressed comments & added two test cases for function pointers.

Jul 23 2018, 5:29 PM

Jul 22 2018

rnkovacs created D49656: [analyzer] Add support for more pointer invalidating functions in InnerPointerChecker.
Jul 22 2018, 8:56 PM

Jul 19 2018

rnkovacs created D49570: [analyzer] Improve warning messages and notes of InnerPointerChecker.
Jul 19 2018, 3:04 PM
rnkovacs created D49568: [analyzer][WIP] Scan the program state map in the visitor only once in DanglingInternalBufferChecker.
Jul 19 2018, 2:45 PM
rnkovacs created D49553: [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.
Jul 19 2018, 9:29 AM

Jul 18 2018

rnkovacs added a comment to D49058: [analyzer] Move InnerPointerChecker out of alpha.

Two more reports on Ceph that seem to be true positives (no other reports from this checker):

  1. Here (or if it does not work, the bug is on L130 here).
  2. Here (or L363 and L373 here).
Jul 18 2018, 9:30 AM

Jul 17 2018

rnkovacs added inline comments to D49360: [analyzer] Add support for more basic_string API in DanglingInternalBufferChecker.
Jul 17 2018, 12:11 PM
rnkovacs updated the diff for D49360: [analyzer] Add support for more basic_string API in DanglingInternalBufferChecker.

Note messages updated.

Jul 17 2018, 12:10 PM

Jul 16 2018

rnkovacs added a comment to D49360: [analyzer] Add support for more basic_string API in DanglingInternalBufferChecker.
In D49360#1163113, @NoQ wrote:

Also we rarely commit to adding a test for every single supported API function; bonus points for that, but usually 2-3 functions from a series of similar functions is enough :)

Jul 16 2018, 3:30 PM
rnkovacs updated the diff for D49360: [analyzer] Add support for more basic_string API in DanglingInternalBufferChecker.

Added standard quote, marking the section about non-member functions that may also invalidate the buffer as a TODO.
Also changed the note message to that suggested by @NoQ (thanks!). All tests pass now.

Jul 16 2018, 3:29 PM
rnkovacs created D49387: [analyzer] Make checkEndFunction() give access to the return statement.
Jul 16 2018, 10:20 AM
rnkovacs added a comment to D49058: [analyzer] Move InnerPointerChecker out of alpha.

@rnkovacs Do you have evaluation statistics handy for this checker? How many bugs it finds, on which projects? How many of those are real bugs?

Jul 16 2018, 10:01 AM

Jul 15 2018

rnkovacs created D49361: [analyzer] Detect pointers escaped after return statement execution in MallocChecker.
Jul 15 2018, 9:48 PM
rnkovacs created D49360: [analyzer] Add support for more basic_string API in DanglingInternalBufferChecker.
Jul 15 2018, 9:20 PM

Jul 10 2018

rnkovacs updated the diff for D49058: [analyzer] Move InnerPointerChecker out of alpha.

Fix test run line.

Jul 10 2018, 1:33 AM

Jul 9 2018

rnkovacs added inline comments to D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 9 2018, 2:33 AM
rnkovacs updated the diff for D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.

Thanks very much for your review!

Jul 9 2018, 2:33 AM

Jul 8 2018

rnkovacs added a dependent revision for D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker: D49058: [analyzer] Move InnerPointerChecker out of alpha.
Jul 8 2018, 11:25 AM
rnkovacs added a dependency for D49058: [analyzer] Move InnerPointerChecker out of alpha: D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 8 2018, 11:25 AM
rnkovacs created D49058: [analyzer] Move InnerPointerChecker out of alpha.
Jul 8 2018, 11:24 AM
rnkovacs added inline comments to D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 8 2018, 11:13 AM
rnkovacs updated the diff for D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 8 2018, 11:13 AM
rnkovacs added inline comments to D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 8 2018, 10:57 AM
rnkovacs updated the diff for D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.

Addressed comments.

Jul 8 2018, 10:57 AM
rnkovacs created D49057: [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.
Jul 8 2018, 10:06 AM

Jul 7 2018

rnkovacs added a comment to D48521: [analyzer] Highlight container object destruction in MallocChecker.

No crashes on Harfbuzz, ICU, Bitcoin, and LLVM. I'll commit.

Jul 7 2018, 9:40 AM

Jun 25 2018

rnkovacs added inline comments to D48532: [analyzer] Add support for std::basic_string::data() in DanglingInternalBufferChecker.
Jun 25 2018, 11:53 AM
rnkovacs updated the diff for D48532: [analyzer] Add support for std::basic_string::data() in DanglingInternalBufferChecker.
Jun 25 2018, 11:52 AM
rnkovacs updated the diff for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.

Fixed the constness of c_str() in the test file.

Jun 25 2018, 10:26 AM
rnkovacs added a dependent revision for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker: D48532: [analyzer] Add support for std::basic_string::data() in DanglingInternalBufferChecker.
Jun 25 2018, 1:01 AM
rnkovacs added a dependency for D48532: [analyzer] Add support for std::basic_string::data() in DanglingInternalBufferChecker: D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.
Jun 25 2018, 1:01 AM
rnkovacs created D48532: [analyzer] Add support for std::basic_string::data() in DanglingInternalBufferChecker.
Jun 25 2018, 1:01 AM
rnkovacs updated the diff for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.

Fixed variable name inside the visitor.
I also clang-formatted the file, sorry for any line number shifting.

Jun 25 2018, 12:15 AM

Jun 24 2018

rnkovacs updated the diff for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.

Thanks! Addressed comments.

Jun 24 2018, 10:03 AM
rnkovacs updated the diff for D48521: [analyzer] Highlight container object destruction in MallocChecker.

Thanks for the comments!
I'll run this on some projects and see if any assertions fail.

Jun 24 2018, 9:54 AM

Jun 23 2018

rnkovacs updated the diff for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.

Um, sorry, I totally forgot about that. Added your case to the tests.

Jun 23 2018, 1:24 PM
rnkovacs added a dependency for D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker: D48521: [analyzer] Highlight container object destruction in MallocChecker.
Jun 23 2018, 12:06 PM
rnkovacs added a dependent revision for D48521: [analyzer] Highlight container object destruction in MallocChecker: D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.
Jun 23 2018, 12:06 PM
rnkovacs created D48522: [analyzer] Highlight c_str() call in DanglingInternalBuffer checker.
Jun 23 2018, 12:04 PM
rnkovacs created D48521: [analyzer] Highlight container object destruction in MallocChecker.
Jun 23 2018, 11:56 AM

Jun 9 2018

rnkovacs updated the diff for D47416: [analyzer] Clean up the program state map of DanglingInternalBufferChecker.

Addressed comments.

Jun 9 2018, 1:57 PM
rnkovacs updated the diff for D47416: [analyzer] Clean up the program state map of DanglingInternalBufferChecker.

Fixed naming and added an extra pass for regions left behind by incomplete destructors.

Jun 9 2018, 7:26 AM

May 31 2018

rnkovacs added a comment to D45517: [analyzer] False positive refutation with Z3.

Just want to comment here and give thanks again for the first version of
the refutation code. It's being really helpful to develop the approach this
code as a base; things would definitely be slower if I had to start it from
scratch.

May 31 2018, 11:48 AM

May 29 2018

rnkovacs added inline comments to D45517: [analyzer] False positive refutation with Z3.
May 29 2018, 10:57 PM

May 28 2018

rnkovacs updated the diff for D47135: [analyzer] A checker for dangling internal buffer pointers in C++.

Added a check for UnknownVal and two FIXMEs (one for the OriginExpr and one for the new CheckKind).

May 28 2018, 10:18 AM

May 26 2018

rnkovacs created D47417: [analyzer] Add missing state transition in IteratorChecker.
May 26 2018, 12:15 PM
rnkovacs added inline comments to D47135: [analyzer] A checker for dangling internal buffer pointers in C++.
May 26 2018, 12:03 PM
rnkovacs added a dependency for D47416: [analyzer] Clean up the program state map of DanglingInternalBufferChecker: D47135: [analyzer] A checker for dangling internal buffer pointers in C++.
May 26 2018, 11:54 AM
rnkovacs added a dependent revision for D47135: [analyzer] A checker for dangling internal buffer pointers in C++: D47416: [analyzer] Clean up the program state map of DanglingInternalBufferChecker.
May 26 2018, 11:54 AM
rnkovacs created D47416: [analyzer] Clean up the program state map of DanglingInternalBufferChecker.
May 26 2018, 11:54 AM
rnkovacs updated the diff for D47135: [analyzer] A checker for dangling internal buffer pointers in C++.

Address (most) comments.

May 26 2018, 11:50 AM
rnkovacs updated the diff for D47135: [analyzer] A checker for dangling internal buffer pointers in C++.
  • All basic_string types are now supported.
  • Mock tests added.
  • New AllocationFamily AF_InternalBuffer introduced.
  • NewDeleteChecker dependency added.
May 26 2018, 11:13 AM

May 22 2018

rnkovacs added a comment to D47135: [analyzer] A checker for dangling internal buffer pointers in C++.

Thanks for your comments!

May 22 2018, 1:18 PM

May 21 2018

rnkovacs added a comment to D47135: [analyzer] A checker for dangling internal buffer pointers in C++.

Adding a preliminary test file.

May 21 2018, 10:05 AM
rnkovacs updated the summary of D47135: [analyzer] A checker for dangling internal buffer pointers in C++.
May 21 2018, 4:48 AM
rnkovacs created D47135: [analyzer] A checker for dangling internal buffer pointers in C++.
May 21 2018, 4:47 AM

May 8 2018

rnkovacs updated the diff for D45517: [analyzer] False positive refutation with Z3.

Expression chaining is fixed. The visitor now collects constraints that are about to disappear along the bug path and checks them once in the end.

May 8 2018, 1:00 PM
rnkovacs added inline comments to D45517: [analyzer] False positive refutation with Z3.
May 8 2018, 1:00 PM

Apr 21 2018

rnkovacs added a comment to D45517: [analyzer] False positive refutation with Z3.
Apr 21 2018, 5:05 AM
rnkovacs added a comment to D45517: [analyzer] False positive refutation with Z3.
In D45517#1074057, @NoQ wrote:

The visitor currently checks states appearing as block edges in the exploded graph. The first idea was to filter states based on the shape of the exploded graph, by checking the number of successors of the parent node, but surprisingly, both succ_size() and pred_size() seemed to return 1 for each node in the graph (except for the root), even if there clearly were branchings in the code (and on the .dot picture). To my understanding, the exploded graph is fully constructed at the stage where visitors are run, so I must be missing something.

Aha, yep, that's probably because visitors are operating on the "trimmed" exploded graph. You can paint it via the -trim-egraph flag or by calling ViewGraph(1) in the debugger.

Apr 21 2018, 5:05 AM
rnkovacs updated the diff for D45517: [analyzer] False positive refutation with Z3.
Apr 21 2018, 4:57 AM
rnkovacs added a dependency for D45517: [analyzer] False positive refutation with Z3: D45920: [analyzer] Move RangeSet related declarations into the RangedConstraintManager header..
Apr 21 2018, 4:55 AM
rnkovacs added a dependent revision for D45920: [analyzer] Move RangeSet related declarations into the RangedConstraintManager header.: D45517: [analyzer] False positive refutation with Z3.
Apr 21 2018, 4:55 AM
rnkovacs created D45920: [analyzer] Move RangeSet related declarations into the RangedConstraintManager header..
Apr 21 2018, 4:54 AM

Apr 20 2018

rnkovacs updated the diff for D45517: [analyzer] False positive refutation with Z3.

Fixed logical operator in the Z3ConstraintManager::checkRangedStateConstraints() function.

Apr 20 2018, 4:36 AM

Apr 11 2018

rnkovacs updated the summary of D45517: [analyzer] False positive refutation with Z3.
Apr 11 2018, 7:31 AM
rnkovacs created D45517: [analyzer] False positive refutation with Z3.
Apr 11 2018, 7:15 AM

Jan 15 2018

rnkovacs added inline comments to D41816: [analyzer] Model and check unrepresentable left shifts.
Jan 15 2018, 1:52 PM
rnkovacs updated the diff for D41816: [analyzer] Model and check unrepresentable left shifts.
Jan 15 2018, 1:52 PM

Jan 11 2018

rnkovacs updated the diff for D41816: [analyzer] Model and check unrepresentable left shifts.

I extended the warning message to include more information. What do you think?

Jan 11 2018, 7:06 AM

Jan 9 2018

rnkovacs added a comment to D41816: [analyzer] Model and check unrepresentable left shifts.

Overall looks good to me, one comment inline. I think it is good to have these checks to prevent the analyzer executing undefined behavior. Maybe this would make it more feasible to run the analyzer with ubsan :)
In the future, it would be great to also look for these cases symbolically, but I believe it is perfectly fine to have that in a separate patch.

Jan 9 2018, 6:18 AM
rnkovacs updated the diff for D41816: [analyzer] Model and check unrepresentable left shifts.
Jan 9 2018, 6:14 AM

Jan 8 2018

rnkovacs created D41816: [analyzer] Model and check unrepresentable left shifts.
Jan 8 2018, 5:24 AM