Repository navigation
fix(uninitialized): a stopped callee in the same file counts as a declaration - #196
Merged
Merged
Conversation
…a declaration A summary from a dataflow stopped before its fixpoint is absent for its effects only when it is imported (#168). In the same file, its callers still apply it: a write turned into an unknown write leaves the local uninitialized, and a parameter without effect reads as "no effect". With a budget of two iterations, a call to such a callee must report what a call to a declaration reports.
…laration A summary from a dataflow stopped before its fixpoint was absent for its effects only when imported. In the same file its callers still applied it: a write downgraded to an unknown write left the local uninitialized, so a later read was reported, and a parameter without effect read as "no effect". Treat it as absent there too, as the cross-TU design prescribes (§4.1): the call gets the presumption for declarations, not the fallback for defined functions without a summary. The caller stays incomplete. Fixes #168
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #168
Problem
When the dataflow of a function stops at its iteration budget, its summary is marked incomplete. Since #157, an imported incomplete summary is absent for its effects. In the same file, callers still applied it:
Reproduced by forcing a budget of 2 iterations on callees whose blocks are laid out before their predecessors:
main*pon every pathUninitializedLocalReadon the caller's read (false positive)*pnever initializedinsteadFix
As the cross-TU design prescribes (§4.1, §5.2, §11), an incomplete summary defined in the same module is now absent for its effects, as an imported one is. The call gets the presumption for declarations (§5.1), not the fallback for defined functions without a summary, which keeps the false positive. An
asDeclarationflag goes through the six helpers of that presumption, which testedcallee->isDeclaration(). The caller stays incomplete, as before.Tests
test/unit/uninit_incomplete_same_file.cand testtestUninitializedIncompleteSummariesInOneFile. With a budget of 2, the callees reportAnalysisIncomplete, and each caller must report exactly what its twin calling a declaration reports. Guards cover the converged results and the completeness of the callers.main: the 2 comparisons fail. GREEN: 7/7, no unit test failure.Before / after (
maindb0c4fe vs this branch, Linux x86_64)defaultandz3: 846 runs, 0 differ, 1287 = 1287 diagnostics.The change only acts when a dataflow does not converge, which does not happen with the automatic budget on these corpora.
Limits
write/sendsinks,memcpy-like transfers) now also apply to a same-file callee with an incomplete summary. No test covers them.Code scanning
CI is green on 50b648f: 13 checks pass, the release attach step is skipped.
main: none new, none gone.github-advanced-securitycomment on this PR. No newcoretrace-concurrency-analyzeralert.