[GSoC-2021] Interested in project `Extend the static analysis pass`

[David Malcolm]

On Sat, 2021-04-10 at 21:18 +0530, Saloni Garg wrote:
> On Thu, Apr 8, 2021 at 8:19 AM David Malcolm <dmalcolm@redhat.com>
> wrote:
> 
> > On Wed, 2021-04-07 at 01:59 +0530, Saloni Garg wrote:

[...]

> > Looking at:
> >   https://gcc.gnu.org/wiki/SummerOfCode#Application
> > we don't have a specific format to be followed.
> > 
> > That said, I saw this
> >   https://google.github.io/gsocguides/student/writing-a-proposal
> > which seems to have useful advice to prospective GSoC students.  In
> > particular, the "Elements of a Quality Proposal" lists various
> > things
> > that in your current draft are missing, and which would strengthen
> > your
> > proposal.  So I'd recommend that you (and other prospective GSoC
> > candidates) have a look at that.
> > 
> Added some new sections. Tried to explain them as well. There are
> some
> things I am not clear about, so explicitly mentioned them and will
> add the
> relevant explanations and present them in the later reports. Please
> let me
> know if this sounds good to you and provide feedback as well.

The updated version looks a lot stronger.

That said, you haven't given details of your programming expertise - in
particular this project will require proficiency with C++, so a good
application would give evidence to the reader that you're already up-
to-speed on writing and debugging C++ (see the "Biographical
Information" section in the guide I linked to above for more info).


[...snip...]

> > FWIW please don't create a top-level function called "free" that
> > isn't
> > the C stdlib's free, it's confusing!
> > 
> Sorry, my bad renamed it to `myfree`.

Thanks!

> > 
> > > int main()
> > > {
> > >    try {
> > >      p = alloc();
> > >      free();
> > >    } catch(...) {
> > >    }
> > >    return 0;
> > > }
> > > Please, have a look here (https://godbolt.org/z/8WvoaP67n). I
> > > believe
> > > it is
> > > a false positive, I am not sure, please confirm.
> > 
> > It looks like one to me.  I had a look at -fdump-analyzer-exploded-
> > graph and the false positive seems to be associated with the edge
> > with
> > the EH flag (to the catch handler).
> > 
> I have understood the exploded graph but not able to understand the
> `EH
> flag` point you are making, so I will get back to you on this.

Edges in control flow graphs can have flags; see the various
DEF_EDGE_FLAG in gcc/cfg-flags.def in the source tree, and in
particular the "EH" flag.

These flags are visible in the analyzer's supergraph - they should
appear in the .dot dump files from the analyzer - so sometimes they're
difficult to see, depending on how GraphViz lays things out.  (FWIW I
use:
  https://github.com/jrfonseca/xdot.py
to view the .dot files; it's fast and convenient)

[...snip...]

> 
> > > 
> > 
> > Currently the analyzer has a "brute force" approach to
> > interprocedural
> > analysis, and attempts to simulate the calls and returns in a
> > fairly
> > direct way.  It's crude (and has exponential growth), but is
> > reasonably
> > simple conceptually (or at least I think so).  The analyzer
> > implements
> > setjmp/longjmp in a similar way, and exception-handling could be
> > based
> > on that code.
> > 
> Going through that already and your comments at the start of every
> data
> structure defined are really helpful.

Thanks!

> 
[...snip...]

Dave