gcc-python-plugin-commits September 2011

gcc-python-plugin-commits@lists.stg.fedorahosted.org

1 participants
71 discussions

[gcc-python-plugin] cpychecker: PyList_SetItem: warn if the list is NULL
by David Hugh Malcolm 26 Sep '11

26 Sep '11

commit cdd03bc42f9277d97442e0a7952014623e1378e9 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Mon Sep 26 17:36:57 2011 -0400 cpychecker: PyList_SetItem: warn if the list is NULL libcpychecker/refcounts.py | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) --- diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index e74000f..57307d8 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -1023,8 +1023,15 @@ class CPython(Facet): def impl_PyList_SetItem(self, stmt, v_list, v_index, v_item): # Decl: # int PyList_SetItem(PyObject *list, Py_ssize_t index, PyObject *item) + # http://docs.python.org/c-api/list.html#PyList_SetItem fnname = stmt.fn.operand.name + # It uses Py_List_Check, a macro which uses Py_TYPE(op) without + # checking op; hence it will segfault will a NULL "list" pointer + self.state.raise_any_null_ptr_func_arg(stmt, 0, v_list) + + # However, it appears to be robust in the face of NULL "item" pointers + result = [] # Is it really a list?

1 0

[gcc-python-plugin] cpychecker: improve detection of uninitialized data
by David Hugh Malcolm 26 Sep '11

26 Sep '11

commit a680a5763be563c266fef9c11830d6750534b34e Author: David Malcolm <dmalcolm(a)redhat.com> Date: Mon Sep 26 17:35:25 2011 -0400 cpychecker: improve detection of uninitialized data Generalize test for deference of an uninitialized pointer: also warn about comparisons that involve uninitialized data, and function calls in which uninitialized data is passed as an argument to a function. libcpychecker/absinterp.py | 39 ++++++++++--- .../read-through-uninitialized-ptr/stderr.txt | 2 +- .../read-through-uninitialized-ptr/stdout.txt | 4 +- .../uninitialized_data/comparison/input.c | 61 ++++++++++++++++++++ .../uninitialized_data/comparison/script.py | 24 ++++++++ .../uninitialized_data/comparison/stderr.txt | 8 +++ .../uninitialized_data/comparison/stdout.txt | 40 +++++++++++++ .../uninitialized_data/function_arg/input.c | 57 ++++++++++++++++++ .../uninitialized_data/function_arg/script.py | 24 ++++++++ .../uninitialized_data/function_arg/stderr.txt | 8 +++ .../uninitialized_data/function_arg/stdout.txt | 40 +++++++++++++ 11 files changed, 296 insertions(+), 11 deletions(-) --- diff --git a/libcpychecker/absinterp.py b/libcpychecker/absinterp.py index 26899be..af32f4b 100644 --- a/libcpychecker/absinterp.py +++ b/libcpychecker/absinterp.py @@ -79,7 +79,7 @@ class AbstractValue: """ Return a boolean, or None (meaning we don't know) """ - raise NotImplementedError + raise NotImplementedError("is_equal for %s" % self) class UnknownValue(AbstractValue): """ @@ -203,6 +203,10 @@ class UninitializedData(AbstractValue): else: return 'uninitialized data' + def is_equal(self, rhs): + # We don't know: + return None + class PredictedError(Exception): pass @@ -229,16 +233,18 @@ class PredictedValueError(PredictedError): self.value = value self.isdefinite = isdefinite -class UninitializedPtrDereference(PredictedValueError): - def __init__(self, state, expr, ptr): +class UsageOfUninitializedData(PredictedValueError): + def __init__(self, state, expr, value, desc): check_isinstance(state, State) check_isinstance(expr, gcc.Tree) - check_isinstance(ptr, AbstractValue) - PredictedValueError.__init__(self, state, expr, ptr, True) + check_isinstance(value, AbstractValue) + PredictedValueError.__init__(self, state, expr, value, True) + check_isinstance(desc, str) + self.desc = desc def __str__(self): - return ('dereferencing uninitialized pointer (%s) at %s' - % (self.expr, self.state.loc.get_stmt().loc)) + return ('%s: %s at %s' + % (self.desc, self.expr, self.state.loc.get_stmt().loc)) class NullPtrDereference(PredictedValueError): def __init__(self, state, expr, ptr, isdefinite): @@ -964,7 +970,8 @@ class State: check_isinstance(ptr, AbstractValue) if isinstance(ptr, UninitializedData): - raise UninitializedPtrDereference(self, expr, ptr) + raise UsageOfUninitializedData(self, expr, ptr, + 'dereferencing uninitialized pointer') if isinstance(ptr, ConcreteValue): if ptr.is_null_ptr(): @@ -1146,6 +1153,14 @@ class State: meth = getattr(facet, 'impl_%s' % fnname) # Evaluate the arguments: args = self.eval_stmt_args(stmt) + + # Check for uninitialized data: + for i, arg in enumerate(args): + if isinstance(arg, UninitializedData): + raise UsageOfUninitializedData(self, stmt.args[i], + arg, + 'passing uninitialized data as argument %i to function' % (i + 1)) + # Call the facet's method: return meth(stmt, *args) @@ -1298,6 +1313,14 @@ class State: if result is not None: return not result + # Detect usage of uninitialized data: + if isinstance(lhs, UninitializedData): + raise UsageOfUninitializedData(self, expr_lhs, lhs, + 'comparison against uninitialized data') + if isinstance(rhs, UninitializedData): + raise UsageOfUninitializedData(self, expr_rhs, rhs, + 'comparison against uninitialized data') + # Specialcasing: comparison of unknown ptr with NULL: if (isinstance(expr_lhs, gcc.VarDecl) and isinstance(expr_rhs, gcc.IntegerCst) diff --git a/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stderr.txt b/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stderr.txt index 72a0877..3b54349 100644 --- a/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stderr.txt +++ b/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stderr.txt @@ -1,3 +1,3 @@ tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c: In function 'test_read_through_uninitialized_pointer': -tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35:5: error: dereferencing uninitialized pointer (coord_ptr->x) at tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35 +tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35:5: error: dereferencing uninitialized pointer: coord_ptr->x at tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35 tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:32:1: note: graphical error report for function 'test_read_through_uninitialized_pointer' written out to 'tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c.test_read_through_uninitialized_pointer-refcount-errors.html' diff --git a/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stdout.txt b/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stdout.txt index b9da615..4ec1576 100644 --- a/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stdout.txt +++ b/tests/cpychecker/absinterp/read-through-uninitialized-ptr/stdout.txt @@ -1,6 +1,6 @@ Trace 0: Transitions: - error: UninitializedPtrDereference() - error: dereferencing uninitialized pointer (coord_ptr->x) at tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35 + error: UsageOfUninitializedData() + error: dereferencing uninitialized pointer: coord_ptr->x at tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:35 Exception: (struct PyObject *)0 from tests/cpychecker/absinterp/read-through-uninitialized-ptr/input.c:32 diff --git a/tests/cpychecker/refcounts/uninitialized_data/comparison/input.c b/tests/cpychecker/refcounts/uninitialized_data/comparison/input.c new file mode 100644 index 0000000..2a98d1a --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/comparison/input.c @@ -0,0 +1,61 @@ +/* + Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> + Copyright 2011 Red Hat, Inc. + + This is free software: you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see + <http://www.gnu.org/licenses/>. +*/ + +#include <Python.h> + +/* + Verify that the checker can cope with various incorrect actions on an + uninitialized pointer +*/ + +PyObject * +test(int len) +{ + PyObject *result = NULL; + PyObject *item; /* never initialized */ + int i; + + result = PyList_New(len); + if (!result) { + goto error; + } + + for (i = 0; i < len; i++) { + /* Erroneous comparison against uninitialized data: */ + if (!item) { + goto error; + } + /* Erroneous call using uninitialized data: */ + PyList_SetItem(result, i, item); + } + + return result; + + error: + Py_XDECREF(result); + return NULL; +} + +/* + PEP-7 +Local variables: +c-basic-offset: 4 +indent-tabs-mode: nil +End: +*/ diff --git a/tests/cpychecker/refcounts/uninitialized_data/comparison/script.py b/tests/cpychecker/refcounts/uninitialized_data/comparison/script.py new file mode 100644 index 0000000..e469f23 --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/comparison/script.py @@ -0,0 +1,24 @@ +# -*- coding: utf-8 -*- +# Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> +# Copyright 2011 Red Hat, Inc. +# +# This is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +import gcc +from libcpychecker import main + +main(verify_refcounting=True, + show_traces=False, + dump_traces=True) diff --git a/tests/cpychecker/refcounts/uninitialized_data/comparison/stderr.txt b/tests/cpychecker/refcounts/uninitialized_data/comparison/stderr.txt new file mode 100644 index 0000000..4ae11f9 --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/comparison/stderr.txt @@ -0,0 +1,8 @@ +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c: In function 'test': +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:41:5: error: comparison against uninitialized data: gcc.VarDecl('item') at tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:41 +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:34:12: note: when PyList_New() succeeds at: result = PyList_New(len); +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:35:8: note: when taking False path at: if (!result) { +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:39:12: note: reaching: for (i = 0; i < len; i++) { +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:39:5: note: when taking True path at: for (i = 0; i < len; i++) { +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:41:5: note: reaching: if (!item) { +tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:29:1: note: graphical error report for function 'test' written out to 'tests/cpychecker/refcounts/uninitialized_data/comparison/input.c.test-refcount-errors.html' diff --git a/tests/cpychecker/refcounts/uninitialized_data/comparison/stdout.txt b/tests/cpychecker/refcounts/uninitialized_data/comparison/stdout.txt new file mode 100644 index 0000000..bacb664 --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/comparison/stdout.txt @@ -0,0 +1,40 @@ +Trace 0: + Transitions: + 'PyList_New() succeeds' + 'taking False path' + 'taking True path' + error: UsageOfUninitializedData() + error: comparison against uninitialized data: gcc.VarDecl('item') at tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:41 + PyListObject allocated at tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:34: + repr(): RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34)) + str(): PyListObject allocated at tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:34 + r->ob_refcnt: refs: 1 + N where N >= 0 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34), region=RegionForGlobal(gcc.VarDecl('PyList_Type'))) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:29 + +Trace 1: + Transitions: + 'PyList_New() succeeds' + 'taking False path' + 'taking False path' + 'returning' + Return value: + repr(): PointerToRegion(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34), region=RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34))) + str(): (struct PyObject *)&RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34)) from tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:34 + r->ob_refcnt: refs: 1 + N where N >= 0 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=34), region=RegionForGlobal(gcc.VarDecl('PyList_Type'))) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:29 + +Trace 2: + Transitions: + 'PyList_New() fails' + 'taking True path' + 'taking True path' + 'returning' + Return value: + repr(): ConcreteValue(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/comparison/input.c', line=52), value=0) + str(): (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:52 + Exception: + (struct PyObject *)&RegionForGlobal(gcc.VarDecl('PyExc_MemoryError')) from tests/cpychecker/refcounts/uninitialized_data/comparison/input.c:34 diff --git a/tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c b/tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c new file mode 100644 index 0000000..a81ed21 --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c @@ -0,0 +1,57 @@ +/* + Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> + Copyright 2011 Red Hat, Inc. + + This is free software: you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see + <http://www.gnu.org/licenses/>. +*/ + +#include <Python.h> + +/* + Verify that the checker can cope with various incorrect actions on an + uninitialized pointer +*/ + +PyObject * +test(int len) +{ + PyObject *result = NULL; + PyObject *item; /* never initialized */ + int i; + + result = PyList_New(len); + if (!result) { + goto error; + } + + for (i = 0; i < len; i++) { + /* Erroneous call using uninitialized data: */ + PyList_SetItem(result, i, item); + } + + return result; + + error: + Py_XDECREF(result); + return NULL; +} + +/* + PEP-7 +Local variables: +c-basic-offset: 4 +indent-tabs-mode: nil +End: +*/ diff --git a/tests/cpychecker/refcounts/uninitialized_data/function_arg/script.py b/tests/cpychecker/refcounts/uninitialized_data/function_arg/script.py new file mode 100644 index 0000000..e469f23 --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/function_arg/script.py @@ -0,0 +1,24 @@ +# -*- coding: utf-8 -*- +# Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> +# Copyright 2011 Red Hat, Inc. +# +# This is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +import gcc +from libcpychecker import main + +main(verify_refcounting=True, + show_traces=False, + dump_traces=True) diff --git a/tests/cpychecker/refcounts/uninitialized_data/function_arg/stderr.txt b/tests/cpychecker/refcounts/uninitialized_data/function_arg/stderr.txt new file mode 100644 index 0000000..c8222fb --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/function_arg/stderr.txt @@ -0,0 +1,8 @@ +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c: In function 'test': +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:41:16: error: passing uninitialized data as argument 3 to function: gcc.VarDecl('item') at tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:41 +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:34:12: note: when PyList_New() succeeds at: result = PyList_New(len); +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:35:8: note: when taking False path at: if (!result) { +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:39:12: note: reaching: for (i = 0; i < len; i++) { +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:39:5: note: when taking True path at: for (i = 0; i < len; i++) { +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:41:16: note: reaching: PyList_SetItem(result, i, item); +tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:29:1: note: graphical error report for function 'test' written out to 'tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c.test-refcount-errors.html' diff --git a/tests/cpychecker/refcounts/uninitialized_data/function_arg/stdout.txt b/tests/cpychecker/refcounts/uninitialized_data/function_arg/stdout.txt new file mode 100644 index 0000000..7e57b5e --- /dev/null +++ b/tests/cpychecker/refcounts/uninitialized_data/function_arg/stdout.txt @@ -0,0 +1,40 @@ +Trace 0: + Transitions: + 'PyList_New() succeeds' + 'taking False path' + 'taking True path' + error: UsageOfUninitializedData() + error: passing uninitialized data as argument 3 to function: gcc.VarDecl('item') at tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:41 + PyListObject allocated at tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:34: + repr(): RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34)) + str(): PyListObject allocated at tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:34 + r->ob_refcnt: refs: 1 + N where N >= 0 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34), region=RegionForGlobal(gcc.VarDecl('PyList_Type'))) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:29 + +Trace 1: + Transitions: + 'PyList_New() succeeds' + 'taking False path' + 'taking False path' + 'returning' + Return value: + repr(): PointerToRegion(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34), region=RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34))) + str(): (struct PyObject *)&RegionOnHeap('PyListObject', gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34)) from tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:34 + r->ob_refcnt: refs: 1 + N where N >= 0 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=34), region=RegionForGlobal(gcc.VarDecl('PyList_Type'))) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:29 + +Trace 2: + Transitions: + 'PyList_New() fails' + 'taking True path' + 'taking True path' + 'returning' + Return value: + repr(): ConcreteValue(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c', line=48), value=0) + str(): (struct PyObject *)0 from tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:48 + Exception: + (struct PyObject *)&RegionForGlobal(gcc.VarDecl('PyExc_MemoryError')) from tests/cpychecker/refcounts/uninitialized_data/function_arg/input.c:34

1 0

[gcc-python-plugin] cpychecker: further renaming to reflect name convention
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit 7b8823b5704a39369c5c15de291d00df6572e0e3 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Sat Sep 24 15:31:29 2011 -0400 cpychecker: further renaming to reflect name convention Rename "new" State to "s_new" Rename the return values from calls to object_ctor as appropriate to follow the naming convention libcpychecker/refcounts.py | 107 ++++++++++++++++++++++++------------------- 1 files changed, 60 insertions(+), 47 deletions(-) --- diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 009789a..e74000f 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -176,8 +176,8 @@ class GenericTpDealloc(AbstractValue): result = state.mktrans_assignment(stmt.lhs, UnknownValue(returntype, stmt.loc), 'calling tp_dealloc on %s' % region) - new = state.copy() - new.loc = state.loc.next_loc() + s_new = state.copy() + s_new.loc = state.loc.next_loc() # Mark the region as deallocated # Since regions are shared with other states, we have to set this up @@ -185,13 +185,13 @@ class GenericTpDealloc(AbstractValue): # value # Clear the value for any fields within the region: for k, v in region.fields.items(): - if v in new.value_for_region: - del new.value_for_region[v] + if v in s_new.value_for_region: + del s_new.value_for_region[v] # Set the default value for the whole region to be "DeallocatedMemory" - new.region_for_var[region] = region - new.value_for_region[region] = DeallocatedMemory(None, stmt.loc) + s_new.region_for_var[region] = region + s_new.value_for_region[region] = DeallocatedMemory(None, stmt.loc) - return [Transition(state, new, desc)] + return [Transition(state, s_new, desc)] class CPython(Facet): def __init__(self, state, exception_rvalue=None, fun=None): @@ -303,8 +303,8 @@ class CPython(Facet): """ Given a gcc.GimpleCall to a Python API function that returns a PyObject*, generate a - (newobj, t_success, t_failure) - triple, where newobj is a region, and success/failure are Transitions + (r_newobj, t_success, t_failure) + triple, where r_newobj is a region, and success/failure are Transitions """ check_isinstance(stmt, gcc.GimpleCall) check_isinstance(stmt.fn.operand, gcc.FunctionDecl) @@ -688,8 +688,9 @@ class CPython(Facet): #t_memoryexc] def impl_PyDict_New(self, stmt): - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyDictObject', 'PyDict_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyDictObject', + 'PyDict_Type') return [t_success, t_failure] def impl_PyDict_SetItem(self, stmt, v_dp, v_key, v_item): @@ -864,8 +865,9 @@ class CPython(Facet): def impl_PyImport_ImportModule(self, stmt, v_name): # http://docs.python.org/c-api/import.html#PyImport_ImportModule - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyModuleObject', 'PyModule_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyModuleObject', + 'PyModule_Type') return [t_success, t_failure] ######################################################################## @@ -943,10 +945,11 @@ class CPython(Facet): # by _PyInt_Init(). Thus, for these values, we know that the call # cannot fail - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyIntObject', 'PyInt_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyIntObject', + 'PyInt_Type') # Set ob_size: - r_ob_size = t_success.dest.make_field_region(newobj, 'ob_ival') + r_ob_size = t_success.dest.make_field_region(r_newobj, 'ob_ival') t_success.dest.value_for_region[r_ob_size] = v_ival if isinstance(v_ival, ConcreteValue): @@ -994,27 +997,28 @@ class CPython(Facet): # Returns a new reference, or raises MemoryError check_isinstance(v_len, AbstractValue) - newobj, success, failure = self.object_ctor(stmt, - 'PyListObject', 'PyList_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyListObject', + 'PyList_Type') # Set ob_size: - ob_size = success.dest.make_field_region(newobj, 'ob_size') - success.dest.value_for_region[ob_size] = v_len + ob_size = t_success.dest.make_field_region(r_newobj, 'ob_size') + t_success.dest.value_for_region[ob_size] = v_len # "Allocate" ob_item, and set it up so that all of the array is # treated as NULL: - ob_item_region = success.dest.make_heap_region( + ob_item_region = t_success.dest.make_heap_region( 'ob_item array for PyListObject', stmt) - success.dest.value_for_region[ob_item_region] = \ + t_success.dest.value_for_region[ob_item_region] = \ ConcreteValue(get_PyObjectPtr(), stmt.loc, 0) - ob_item = success.dest.make_field_region(newobj, 'ob_item') - success.dest.value_for_region[ob_item] = PointerToRegion(get_PyObjectPtr().pointer, + ob_item = t_success.dest.make_field_region(r_newobj, 'ob_item') + t_success.dest.value_for_region[ob_item] = PointerToRegion(get_PyObjectPtr().pointer, stmt.loc, ob_item_region) - return [success, failure] + return [t_success, t_failure] def impl_PyList_SetItem(self, stmt, v_list, v_index, v_item): # Decl: @@ -1057,24 +1061,27 @@ class CPython(Facet): # PyLong_* ######################################################################## def impl_PyLong_FromLong(self, stmt, v_long): - newobj, success, failure = self.object_ctor(stmt, - 'PyLongObject', 'PyLong_Type') - return [success, failure] + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyLongObject', + 'PyLong_Type') + return [t_success, t_failure] def impl_PyLong_FromString(self, stmt, v_str, v_pend, v_base): # Declared in longobject.h as: # PyAPI_FUNC(PyObject *) PyLong_FromString(char *, char **, int); # Defined in longobject.c # http://docs.python.org/c-api/long.html#PyLong_FromString - newobj, success, failure = self.object_ctor(stmt, - 'PyLongObject', 'PyLong_Type') - return [success, failure] + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyLongObject', + 'PyLong_Type') + return [t_success, t_failure] def impl_PyLong_FromVoidPtr(self, stmt, v_p): # http://docs.python.org/c-api/long.html#PyLong_FromVoidPtr - newobj, success, failure = self.object_ctor(stmt, - 'PyLongObject', 'PyLong_Type') - return [success, failure] + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyLongObject', + 'PyLong_Type') + return [t_success, t_failure] ######################################################################## # PyMem_* @@ -1246,8 +1253,9 @@ class CPython(Facet): # PyAPI_FUNC(PyObject *) PyObject_Repr(PyObject *); # Docs: # http://docs.python.org/c-api/object.html#PyObject_Repr - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyStringObject', 'PyString_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyStringObject', + 'PyString_Type') return [t_success, t_failure] def impl_PyObject_Str(self, stmt, v_o): @@ -1255,8 +1263,9 @@ class CPython(Facet): # PyAPI_FUNC(PyObject *) PyObject_Str(PyObject *); # also with: # #define PyObject_Bytes PyObject_Str - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyStringObject', 'PyString_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyStringObject', + 'PyString_Type') return [t_success, t_failure] ######################################################################## @@ -1330,8 +1339,9 @@ class CPython(Facet): # # (We do not yet check that the format string matches the types of the # varargs) - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyStringObject', 'PyString_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyStringObject', + 'PyString_Type') return [t_success, t_failure] def impl_PyString_FromString(self, stmt, v_str): @@ -1344,8 +1354,9 @@ class CPython(Facet): # The input _must_ be non-NULL; it is not checked: self.state.raise_any_null_ptr_func_arg(stmt, 0, v_str) - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyStringObject', 'PyString_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyStringObject', + 'PyString_Type') return [t_success, t_failure] def impl_PyString_FromStringAndSize(self, stmt, v_str, v_size): @@ -1361,8 +1372,9 @@ class CPython(Facet): # v_str, v_size = self.state.eval_stmt_args(stmt) # (the input can legitimately be NULL) - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyStringObject', 'PyString_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyStringObject', + 'PyString_Type') return [t_success, t_failure] ######################################################################## @@ -1431,10 +1443,11 @@ class CPython(Facet): def impl_PyTuple_New(self, stmt, v_len): # http://docs.python.org/c-api/tuple.html#PyTuple_New - newobj, t_success, t_failure = self.object_ctor(stmt, - 'PyTupleObject', 'PyTuple_Type') + r_newobj, t_success, t_failure = self.object_ctor(stmt, + 'PyTupleObject', + 'PyTuple_Type') # Set ob_size: - r_ob_size = t_success.dest.make_field_region(newobj, 'ob_size') + r_ob_size = t_success.dest.make_field_region(r_newobj, 'ob_size') t_success.dest.value_for_region[r_ob_size] = v_len return [t_success, t_failure]

1 0

[gcc-python-plugin] cpychecker: rename arguments to impl_ functions
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit 311807de9359aa42bdf4e41a9ffd26b061149266 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Sat Sep 24 15:08:05 2011 -0400 cpychecker: rename arguments to impl_ functions Rename various arguments to impl_functions so that they have v_ prefixes, reflecting the naming convention for AbstractValue instances libcpychecker/refcounts.py | 32 ++++++++++++++++---------------- 1 files changed, 16 insertions(+), 16 deletions(-) --- diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 8e055c5..009789a 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -959,7 +959,7 @@ class CPython(Facet): ######################################################################## # PyList_* ######################################################################## - def impl_PyList_Append(self, stmt, op, newitem): + def impl_PyList_Append(self, stmt, v_op, v_newitem): # Declared in listobject.h as: # PyAPI_FUNC(int) PyList_Append(PyObject *, PyObject *); # @@ -972,15 +972,15 @@ class CPython(Facet): # On success, adds a ref on input: s_success = self.state.mkstate_concrete_return_of(stmt, 0) - s_success.cpython.add_ref(newitem, stmt.loc) + s_success.cpython.add_ref(v_newitem, stmt.loc) #...and set the pointer value within ob_item array, so that we can # discount that refcount: - ob_item_region = self.state.make_field_region(op.region, 'ob_item') - ob_size_region = self.state.make_field_region(op.region, 'ob_size') + ob_item_region = self.state.make_field_region(v_op.region, 'ob_item') + ob_size_region = self.state.make_field_region(v_op.region, 'ob_size') check_isinstance(s_success.value_for_region[ob_size_region], ConcreteValue) # for now index = s_success.value_for_region[ob_size_region].value array_region = s_success._array_region(ob_item_region, index) - s_success.value_for_region[array_region] = newitem + s_success.value_for_region[array_region] = v_newitem # Can fail with memory error, overflow error: s_failure = self.state.mkstate_concrete_return_of(stmt, -1) @@ -988,17 +988,17 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyList_New(self, stmt, lenarg): + def impl_PyList_New(self, stmt, v_len): # Decl: # PyObject* PyList_New(Py_ssize_t len) # Returns a new reference, or raises MemoryError - check_isinstance(lenarg, AbstractValue) + check_isinstance(v_len, AbstractValue) newobj, success, failure = self.object_ctor(stmt, 'PyListObject', 'PyList_Type') # Set ob_size: ob_size = success.dest.make_field_region(newobj, 'ob_size') - success.dest.value_for_region[ob_size] = lenarg + success.dest.value_for_region[ob_size] = v_len # "Allocate" ob_item, and set it up so that all of the array is # treated as NULL: @@ -1016,7 +1016,7 @@ class CPython(Facet): return [success, failure] - def impl_PyList_SetItem(self, stmt, arg_list, arg_index, arg_item): + def impl_PyList_SetItem(self, stmt, v_list, v_index, v_item): # Decl: # int PyList_SetItem(PyObject *list, Py_ssize_t index, PyObject *item) fnname = stmt.fn.operand.name @@ -1041,9 +1041,9 @@ class CPython(Facet): s_success = self.state.mkstate_concrete_return_of(stmt, 0) # FIXME: update refcounts # "Steal" a reference to item: - if isinstance(arg_item, PointerToRegion): - check_isinstance(arg_item.region, Region) - s_success.cpython.steal_reference(arg_item.region) + if isinstance(v_item, PointerToRegion): + check_isinstance(v_item.region, Region) + s_success.cpython.steal_reference(v_item.region) # and discards a # reference to an item already in the list at the affected position. @@ -1212,7 +1212,7 @@ class CPython(Facet): Transition(self.state, s_false, '%s() returns 0 (false)' % fnname), Transition(self.state, s_failure, '%s() returns -1 (failure)' % fnname)] - def impl__PyObject_New(self, stmt, tp_rvalue): + def impl__PyObject_New(self, stmt, v_typeptr): # Declaration in objimpl.h: # PyAPI_FUNC(PyObject *) _PyObject_New(PyTypeObject *); # @@ -1230,7 +1230,7 @@ class CPython(Facet): s_success, nonnull = self.mkstate_new_ref(stmt, '_PyObject_New') # ...and set up ob_type on the result object: ob_type = s_success.make_field_region(nonnull, 'ob_type') - s_success.value_for_region[ob_type] = tp_rvalue + s_success.value_for_region[ob_type] = v_typeptr t_success = Transition(self.state, s_success, '_PyObject_New() succeeds') @@ -1375,7 +1375,7 @@ class CPython(Facet): # For now, treat it as a no-op: return [self.state.mktrans_nop(stmt, 'PyStructSequence_InitType')] - def impl_PyStructSequence_New(self, stmt, tp_rvalue): + def impl_PyStructSequence_New(self, stmt, v_typeptr): # Declared in structseq.h as: # PyAPI_FUNC(PyObject *) PyStructSequence_New(PyTypeObject* type); # @@ -1389,7 +1389,7 @@ class CPython(Facet): s_success, nonnull = self.mkstate_new_ref(stmt, 'PyStructSequence_New') # ...and set up ob_type on the result object: ob_type = s_success.make_field_region(nonnull, 'ob_type') - s_success.value_for_region[ob_type] = tp_rvalue + s_success.value_for_region[ob_type] = v_typeptr t_success = Transition(self.state, s_success, 'PyStructSequence_New() succeeds')

1 0

[gcc-python-plugin] cpychecker: rename impl_object_ctor method
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit 617549ff7db749449d395ab22ecc651a833db8d8 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Sat Sep 24 14:52:45 2011 -0400 cpychecker: rename impl_object_ctor method The "impl_" prefix has special meaning for methods of Facet subclasses Rename CPython's "impl_object_ctor" method to just "object_ctor", as it does not implement a C function. libcpychecker/refcounts.py | 28 ++++++++++++++-------------- 1 files changed, 14 insertions(+), 14 deletions(-) --- diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index ec3ad9c..8e055c5 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -299,7 +299,7 @@ class CPython(Facet): v_exception = PointerToRegion(get_PyObjectPtr(), loc, r_exception) self.exception_rvalue = v_exception - def impl_object_ctor(self, stmt, typename, typeobjname): + def object_ctor(self, stmt, typename, typeobjname): """ Given a gcc.GimpleCall to a Python API function that returns a PyObject*, generate a @@ -688,7 +688,7 @@ class CPython(Facet): #t_memoryexc] def impl_PyDict_New(self, stmt): - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyDictObject', 'PyDict_Type') return [t_success, t_failure] @@ -864,7 +864,7 @@ class CPython(Facet): def impl_PyImport_ImportModule(self, stmt, v_name): # http://docs.python.org/c-api/import.html#PyImport_ImportModule - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyModuleObject', 'PyModule_Type') return [t_success, t_failure] @@ -943,7 +943,7 @@ class CPython(Facet): # by _PyInt_Init(). Thus, for these values, we know that the call # cannot fail - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyIntObject', 'PyInt_Type') # Set ob_size: r_ob_size = t_success.dest.make_field_region(newobj, 'ob_ival') @@ -994,7 +994,7 @@ class CPython(Facet): # Returns a new reference, or raises MemoryError check_isinstance(lenarg, AbstractValue) - newobj, success, failure = self.impl_object_ctor(stmt, + newobj, success, failure = self.object_ctor(stmt, 'PyListObject', 'PyList_Type') # Set ob_size: ob_size = success.dest.make_field_region(newobj, 'ob_size') @@ -1057,7 +1057,7 @@ class CPython(Facet): # PyLong_* ######################################################################## def impl_PyLong_FromLong(self, stmt, v_long): - newobj, success, failure = self.impl_object_ctor(stmt, + newobj, success, failure = self.object_ctor(stmt, 'PyLongObject', 'PyLong_Type') return [success, failure] @@ -1066,13 +1066,13 @@ class CPython(Facet): # PyAPI_FUNC(PyObject *) PyLong_FromString(char *, char **, int); # Defined in longobject.c # http://docs.python.org/c-api/long.html#PyLong_FromString - newobj, success, failure = self.impl_object_ctor(stmt, + newobj, success, failure = self.object_ctor(stmt, 'PyLongObject', 'PyLong_Type') return [success, failure] def impl_PyLong_FromVoidPtr(self, stmt, v_p): # http://docs.python.org/c-api/long.html#PyLong_FromVoidPtr - newobj, success, failure = self.impl_object_ctor(stmt, + newobj, success, failure = self.object_ctor(stmt, 'PyLongObject', 'PyLong_Type') return [success, failure] @@ -1246,7 +1246,7 @@ class CPython(Facet): # PyAPI_FUNC(PyObject *) PyObject_Repr(PyObject *); # Docs: # http://docs.python.org/c-api/object.html#PyObject_Repr - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyStringObject', 'PyString_Type') return [t_success, t_failure] @@ -1255,7 +1255,7 @@ class CPython(Facet): # PyAPI_FUNC(PyObject *) PyObject_Str(PyObject *); # also with: # #define PyObject_Bytes PyObject_Str - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyStringObject', 'PyString_Type') return [t_success, t_failure] @@ -1330,7 +1330,7 @@ class CPython(Facet): # # (We do not yet check that the format string matches the types of the # varargs) - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyStringObject', 'PyString_Type') return [t_success, t_failure] @@ -1344,7 +1344,7 @@ class CPython(Facet): # The input _must_ be non-NULL; it is not checked: self.state.raise_any_null_ptr_func_arg(stmt, 0, v_str) - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyStringObject', 'PyString_Type') return [t_success, t_failure] @@ -1361,7 +1361,7 @@ class CPython(Facet): # v_str, v_size = self.state.eval_stmt_args(stmt) # (the input can legitimately be NULL) - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyStringObject', 'PyString_Type') return [t_success, t_failure] @@ -1431,7 +1431,7 @@ class CPython(Facet): def impl_PyTuple_New(self, stmt, v_len): # http://docs.python.org/c-api/tuple.html#PyTuple_New - newobj, t_success, t_failure = self.impl_object_ctor(stmt, + newobj, t_success, t_failure = self.object_ctor(stmt, 'PyTupleObject', 'PyTuple_Type') # Set ob_size: r_ob_size = t_success.dest.make_field_region(newobj, 'ob_size')

1 0

[gcc-python-plugin] cpychecker: evaluate arguments before invoking an "impl_" method
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit e22ed6b2aa52b3ce0f3e605ecf1472cef9077343 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Sat Sep 24 14:40:46 2011 -0400 cpychecker: evaluate arguments before invoking an "impl_" method Previously, each impl_ method had responsibility for evaluating the gcc.GimpleCall statement's arguments, turning them into AbstractValue instances. With this commit, this is done before calling the impl_ method, so that each impl_ method now has a signature that reflects that of the underlying C function (sometimes with varargs) libcpychecker/absinterp.py | 14 +++- libcpychecker/refcounts.py | 183 +++++++++++++++----------------------------- 2 files changed, 74 insertions(+), 123 deletions(-) --- diff --git a/libcpychecker/absinterp.py b/libcpychecker/absinterp.py index d6306df..26899be 100644 --- a/libcpychecker/absinterp.py +++ b/libcpychecker/absinterp.py @@ -1131,13 +1131,23 @@ class State: log('stmt.fn.operand.name: %r', stmt.fn.operand.name) fnname = stmt.fn.operand.name - # Hand off to impl_* methods of facets, where these methods exist: + # Hand off to impl_* methods of facets, where these methods exist + # In each case, the method should have the form: + # def impl_foo(self, stmt, v_arg0, v_arg1, *args): + # for a C function named "foo" i.e. it takes "self", plus the + # gcc.GimpleCall statement, followed by the AbstractValue instances + # for the evaluated arguments (which for some functions will + # involve varargs, like above). + # They should return a list of Transition instances. methname = 'impl_%s' % fnname for key in self.facets: facet = getattr(self, key) if hasattr(facet, methname): meth = getattr(facet, 'impl_%s' % fnname) - return meth(stmt) + # Evaluate the arguments: + args = self.eval_stmt_args(stmt) + # Call the facet's method: + return meth(stmt, *args) #from libcpychecker.c_stdio import c_stdio_functions, handle_c_stdio_function diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index a7dd910..ec3ad9c 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -477,7 +477,7 @@ class CPython(Facet): # Treat calls to various function prefixed with __cpychecker as special, # to help with debugging, and when writing selftests: - def impl___cpychecker_log(self, stmt): + def impl___cpychecker_log(self, stmt, *args): """ Assuming a C function with this declaration: extern void __cpychecker_log(const char *); @@ -485,7 +485,6 @@ class CPython(Facet): within the trace. """ returntype = stmt.fn.type.dereference.type - args = self.state.eval_stmt_args(stmt) desc = None if isinstance(args[0], PointerToRegion): if isinstance(args[0].region, RegionForStringConstant): @@ -494,18 +493,17 @@ class CPython(Facet): UnknownValue(returntype, stmt.loc), desc)] - def impl___cpychecker_dump(self, stmt): + def impl___cpychecker_dump(self, stmt, *args): returntype = stmt.fn.type.dereference.type # Give the transition a description that embeds the argument values # This will show up in selftests (and in error reports that embed # traces) - args = self.state.eval_stmt_args(stmt) desc = '__dump(%s)' % (','.join([str(arg) for arg in args])) return [self.state.mktrans_assignment(stmt.lhs, UnknownValue(returntype, stmt.loc), desc)] - def impl___cpychecker_assert_equal(self, stmt): + def impl___cpychecker_assert_equal(self, stmt, *args): """ Assuming a C function with this declaration: extern void __cpychecker_assert_equal(T, T); @@ -516,7 +514,6 @@ class CPython(Facet): # Give the transition a description that embeds the argument values # This will show up in selftests (and in error reports that embed # traces) - args = self.state.eval_stmt_args(stmt) if args[0] != args[1]: raise AssertionError('%s != %s' % (args[0], args[1])) desc = '__cpychecker_assert_equal(%s)' % (','.join([str(arg) for arg in args])) @@ -535,7 +532,7 @@ class CPython(Facet): Handle one of the various PyArg_Parse* functions """ check_isinstance(v_fmt, AbstractValue) - check_isinstance(v_varargs, list) # of AbstractValue + check_isinstance(v_varargs, tuple) # of AbstractValue check_isinstance(with_size_t, bool) s_success = self.state.mkstate_concrete_return_of(stmt, 1) @@ -602,31 +599,24 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyArg_ParseTuple(self, stmt): + def impl_PyArg_ParseTuple(self, stmt, v_args, v_fmt, *v_varargs): # Declared in modsupport.h: # PyAPI_FUNC(int) PyArg_ParseTuple(PyObject *, const char *, ...) Py_FORMAT_PARSETUPLE(PyArg_ParseTuple, 2, 3); # Also, with #ifdef PY_SSIZE_T_CLEAN # #define PyArg_ParseTuple _PyArg_ParseTuple_SizeT - args = self.state.eval_stmt_args(stmt) - v_args = args[0] - v_fmt = args[1] - v_varargs = args[2:] return self._handle_PyArg_function(stmt, v_fmt, v_varargs, with_size_t=False) - def impl__PyArg_ParseTuple_SizeT(self, stmt): + def impl__PyArg_ParseTuple_SizeT(self, stmt, v_args, v_fmt, *v_varargs): # Declared in modsupport.h: # PyAPI_FUNC(int) PyArg_ParseTuple(PyObject *, const char *, ...) Py_FORMAT_PARSETUPLE(PyArg_ParseTuple, 2, 3); # Also, with #ifdef PY_SSIZE_T_CLEAN # #define PyArg_ParseTuple _PyArg_ParseTuple_SizeT - args = self.state.eval_stmt_args(stmt) - v_args = args[0] - v_fmt = args[1] - v_varargs = args[2:] return self._handle_PyArg_function(stmt, v_fmt, v_varargs, with_size_t=True) - def impl_PyArg_ParseTupleAndKeywords(self, stmt): + def impl_PyArg_ParseTupleAndKeywords(self, stmt, v_args, v_kwargs, + v_fmt, v_keywords, *v_varargs): # Declared in modsupport.h: # PyAPI_FUNC(int) PyArg_ParseTupleAndKeywords(PyObject *, PyObject *, # const char *, char **, ...); @@ -634,15 +624,10 @@ class CPython(Facet): # Also, with #ifdef PY_SSIZE_T_CLEAN # #define PyArg_ParseTupleAndKeywords _PyArg_ParseTupleAndKeywords_SizeT - args = self.state.eval_stmt_args(stmt) - v_args = args[0] - v_kwargs = args[1] - v_fmt = args[2] - v_keywords = args[3] - v_varargs = args[4:] return self._handle_PyArg_function(stmt, v_fmt, v_varargs, with_size_t=False) - def impl_PyArg_ParseTupleAndKeywords_SizeT(self, stmt): + def impl_PyArg_ParseTupleAndKeywords_SizeT(self, stmt, v_args, v_kwargs, + v_fmt, v_keywords, *v_varargs): # Declared in modsupport.h: # PyAPI_FUNC(int) PyArg_ParseTupleAndKeywords(PyObject *, PyObject *, # const char *, char **, ...); @@ -650,18 +635,12 @@ class CPython(Facet): # Also, with #ifdef PY_SSIZE_T_CLEAN # #define PyArg_ParseTupleAndKeywords _PyArg_ParseTupleAndKeywords_SizeT - args = self.state.eval_stmt_args(stmt) - v_args = args[0] - v_kwargs = args[1] - v_fmt = args[2] - v_keywords = args[3] - v_varargs = args[4:] return self._handle_PyArg_function(stmt, v_fmt, v_varargs, with_size_t=True) ######################################################################## # PyBool_* ######################################################################## - def impl_PyBool_FromLong(self, stmt): + def impl_PyBool_FromLong(self, stmt, v_long): # Declared in boolobject.h: # PyAPI_FUNC(PyObject *) PyBool_FromLong(long); # Defined in Objects/boolobject.c @@ -675,7 +654,7 @@ class CPython(Facet): ######################################################################## # PyDict_* ######################################################################## - def impl_PyDict_GetItem(self, stmt): + def impl_PyDict_GetItem(self, stmt, v_mp, v_key): # Declared in dictobject.h: # PyAPI_FUNC(PyObject *) PyDict_GetItem(PyObject *mp, PyObject *key); # Defined in dictobject.c @@ -689,7 +668,7 @@ class CPython(Facet): return [self.state.mktrans_from_fncall_state(stmt, s_success, 'succeeds'), t_notfound] - def impl_PyDict_GetItemString(self, stmt): + def impl_PyDict_GetItemString(self, stmt, v_dp, v_key): # Declared in dictobject.h: # PyAPI_FUNC(PyObject *) PyDict_GetItemString(PyObject *dp, const char *key); # Defined in dictobject.c @@ -713,7 +692,7 @@ class CPython(Facet): 'PyDictObject', 'PyDict_Type') return [t_success, t_failure] - def impl_PyDict_SetItem(self, stmt): + def impl_PyDict_SetItem(self, stmt, v_dp, v_key, v_item): # Declared in dictobject.h: # PyAPI_FUNC(int) PyDict_SetItem(PyObject *mp, PyObject *key, PyObject *item); # Defined in dictobject.c @@ -722,8 +701,6 @@ class CPython(Facet): # http://docs.python.org/c-api/dict.html#PyDict_SetItem # Can return -1, setting MemoryError # Otherwise returns 0, and adds a ref on the value - v_dp, v_key, v_item = self.state.eval_stmt_args(stmt) - self.state.raise_any_null_ptr_func_arg(stmt, 1, v_key) self.state.raise_any_null_ptr_func_arg(stmt, 2, v_item) @@ -738,7 +715,7 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyDict_SetItemString(self, stmt): + def impl_PyDict_SetItemString(self, stmt, v_dp, v_key, v_item): # Declared in dictobject.h: # PyAPI_FUNC(int) PyDict_SetItemString(PyObject *dp, const char *key, PyObject *item); # Defined in dictobject.c @@ -747,25 +724,23 @@ class CPython(Facet): # http://docs.python.org/c-api/dict.html#PyDict_SetItemString # Can return -1, setting MemoryError # Otherwise returns 0, and adds a ref on the value - v_dp, v_key, v_item = self.state.eval_stmt_args(stmt) # This is implemented in terms of PyDict_SetItem and shows the same # success and failures: self.state.raise_any_null_ptr_func_arg(stmt, 1, v_key) self.state.raise_any_null_ptr_func_arg(stmt, 2, v_item) - return self.impl_PyDict_SetItem(stmt) + # (strictly speaking, v_key goes from being a char* to a PyObject*) + return self.impl_PyDict_SetItem(stmt, v_dp, v_key, v_item) ######################################################################## # PyErr_* ######################################################################## - def impl_PyErr_Format(self, stmt): + def impl_PyErr_Format(self, stmt, v_exc, v_fmt, *v_args): # Declared in pyerrors.h: # PyAPI_FUNC(void) PyErr_SetString(PyObject *, const char *); # Defined in Python/errors.c # - args = self.state.eval_stmt_args(stmt) - v_exc = args[0] - v_fmt = args[1] + # It always returns NULL: t_next = self.state.mktrans_assignment(stmt.lhs, make_null_pyobject_ptr(stmt), @@ -809,7 +784,7 @@ class CPython(Facet): t_next.dest.cpython.exception_rvalue = make_null_pyobject_ptr(stmt) return [t_next] - def impl_PyErr_PrintEx(self, stmt): + def impl_PyErr_PrintEx(self, stmt, v_int): # Declared in pythonrun.h: # PyAPI_FUNC(void) PyErr_PrintEx(int); # Defined in pythonrun.c @@ -819,12 +794,10 @@ class CPython(Facet): t_next.dest.cpython.exception_rvalue = make_null_pyobject_ptr(stmt) return [t_next] - def impl_PyErr_SetFromErrno(self, stmt): + def impl_PyErr_SetFromErrno(self, stmt, v_exc): # API docs: # http://docs.python.org/c-api/exceptions.html#PyErr_SetFromErrno # - args = self.state.eval_stmt_args(stmt) - v_exc = args[0] # It always returns NULL: t_next = self.state.mktrans_assignment(stmt.lhs, make_null_pyobject_ptr(stmt), @@ -832,9 +805,7 @@ class CPython(Facet): t_next.dest.cpython.exception_rvalue = v_exc return [t_next] - def impl_PyErr_SetFromErrnoWithFilename(self, stmt): - args = self.state.eval_stmt_args(stmt) - v_exc = args[0] + def impl_PyErr_SetFromErrnoWithFilename(self, stmt, v_exc): # It always returns NULL: t_next = self.state.mktrans_assignment(stmt.lhs, make_null_pyobject_ptr(stmt), @@ -842,12 +813,11 @@ class CPython(Facet): t_next.dest.cpython.exception_rvalue = v_exc return [t_next] - def impl_PyErr_SetString(self, stmt): + def impl_PyErr_SetString(self, stmt, v_exc, v_string): # Declared in pyerrors.h: # PyAPI_FUNC(void) PyErr_SetString(PyObject *, const char *); # Defined in Python/errors.c # - v_exc, v_string = self.state.eval_stmt_args(stmt) t_next = self.state.mktrans_nop(stmt, 'PyErr_SetString') t_next.dest.cpython.exception_rvalue = v_exc return [t_next] @@ -876,7 +846,7 @@ class CPython(Facet): # For now, treat it as a no-op: return [self.state.mktrans_nop(stmt, 'PyGILState_Ensure')] - def impl_PyGILState_Release(self, stmt): + def impl_PyGILState_Release(self, stmt, v_state): # http://docs.python.org/c-api/init.html#PyGILState_Release # For now, treat it as a no-op: return [self.state.mktrans_nop(stmt, 'PyGILState_Release')] @@ -884,7 +854,7 @@ class CPython(Facet): ######################################################################## # PyImport_* ######################################################################## - def impl_PyImport_AppendInittab(self, stmt): + def impl_PyImport_AppendInittab(self, stmt, v_name, v_initfunc): # http://docs.python.org/c-api/import.html#PyImport_AppendInittab s_success = self.state.mkstate_concrete_return_of(stmt, 0) s_failure = self.state.mkstate_concrete_return_of(stmt, -1) @@ -892,7 +862,7 @@ class CPython(Facet): # have been called yet, in any case) return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyImport_ImportModule(self, stmt): + def impl_PyImport_ImportModule(self, stmt, v_name): # http://docs.python.org/c-api/import.html#PyImport_ImportModule newobj, t_success, t_failure = self.impl_object_ctor(stmt, 'PyModuleObject', 'PyModule_Type') @@ -909,7 +879,8 @@ class CPython(Facet): ######################################################################## # Py_InitModule* ######################################################################## - def impl_Py_InitModule4_64(self, stmt): + def impl_Py_InitModule4_64(self, stmt, v_name, v_methods, + v_doc, v_self, v_apiver): # Decl: # PyAPI_FUNC(PyObject *) Py_InitModule4(const char *name, PyMethodDef *methods, # const char *doc, PyObject *self, @@ -929,7 +900,7 @@ class CPython(Facet): ######################################################################## # Py_Int* ######################################################################## - def impl_PyInt_AsLong(self, stmt): + def impl_PyInt_AsLong(self, stmt, v_op): # Declared in intobject.h as: # PyAPI_FUNC(long) PyInt_AsLong(PyObject *); # Defined in Objects/intobject.c @@ -938,9 +909,6 @@ class CPython(Facet): # Can fail (gracefully) with NULL, and with non-int objects - args = self.state.eval_stmt_args(stmt) - v_op = args[0] - returntype = stmt.fn.type.dereference.type if self.object_ptr_has_global_ob_type(v_op, 'PyInt_Type'): @@ -964,7 +932,7 @@ class CPython(Facet): t_failure.dest.cpython.set_exception('PyExc_MemoryError', stmt.loc) return [t_success, t_failure] - def impl_PyInt_FromLong(self, stmt): + def impl_PyInt_FromLong(self, stmt, v_ival): # Declared in intobject.h as: # PyAPI_FUNC(PyObject *) PyInt_FromLong(long); # Defined in Objects/intobject.c @@ -975,9 +943,6 @@ class CPython(Facet): # by _PyInt_Init(). Thus, for these values, we know that the call # cannot fail - args = self.state.eval_stmt_args(stmt) - v_ival = args[0] - newobj, t_success, t_failure = self.impl_object_ctor(stmt, 'PyIntObject', 'PyInt_Type') # Set ob_size: @@ -994,7 +959,7 @@ class CPython(Facet): ######################################################################## # PyList_* ######################################################################## - def impl_PyList_Append(self, stmt): + def impl_PyList_Append(self, stmt, op, newitem): # Declared in listobject.h as: # PyAPI_FUNC(int) PyList_Append(PyObject *, PyObject *); # @@ -1004,7 +969,6 @@ class CPython(Facet): # # If it succeeds, it adds a reference on the item # - op, newitem = self.state.eval_stmt_args(stmt) # On success, adds a ref on input: s_success = self.state.mkstate_concrete_return_of(stmt, 0) @@ -1024,11 +988,11 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyList_New(self, stmt): + def impl_PyList_New(self, stmt, lenarg): # Decl: # PyObject* PyList_New(Py_ssize_t len) # Returns a new reference, or raises MemoryError - lenarg = self.state.eval_rvalue(stmt.args[0], stmt.loc) + check_isinstance(lenarg, AbstractValue) newobj, success, failure = self.impl_object_ctor(stmt, 'PyListObject', 'PyList_Type') @@ -1052,16 +1016,13 @@ class CPython(Facet): return [success, failure] - def impl_PyList_SetItem(self, stmt): + def impl_PyList_SetItem(self, stmt, arg_list, arg_index, arg_item): # Decl: # int PyList_SetItem(PyObject *list, Py_ssize_t index, PyObject *item) fnname = stmt.fn.operand.name result = [] - arg_list, arg_index, arg_item = [self.state.eval_rvalue(arg, stmt.loc) - for arg in stmt.args] - # Is it really a list? if 0: # FIXME: check not_a_list = self.state.mkstate_concrete_return_of(stmt, -1) @@ -1095,20 +1056,21 @@ class CPython(Facet): ######################################################################## # PyLong_* ######################################################################## - def impl_PyLong_FromLong(self, stmt): + def impl_PyLong_FromLong(self, stmt, v_long): newobj, success, failure = self.impl_object_ctor(stmt, 'PyLongObject', 'PyLong_Type') return [success, failure] - def impl_PyLong_FromString(self, stmt): + def impl_PyLong_FromString(self, stmt, v_str, v_pend, v_base): # Declared in longobject.h as: # PyAPI_FUNC(PyObject *) PyLong_FromString(char *, char **, int); # Defined in longobject.c + # http://docs.python.org/c-api/long.html#PyLong_FromString newobj, success, failure = self.impl_object_ctor(stmt, 'PyLongObject', 'PyLong_Type') return [success, failure] - def impl_PyLong_FromVoidPtr(self, stmt): + def impl_PyLong_FromVoidPtr(self, stmt, v_p): # http://docs.python.org/c-api/long.html#PyLong_FromVoidPtr newobj, success, failure = self.impl_object_ctor(stmt, 'PyLongObject', 'PyLong_Type') @@ -1117,11 +1079,9 @@ class CPython(Facet): ######################################################################## # PyMem_* ######################################################################## - def impl_PyMem_Free(self, stmt): + def impl_PyMem_Free(self, stmt, v_ptr): # http://docs.python.org/c-api/memory.html#PyMem_Free fnname = 'PyMem_Free' - args = self.state.eval_stmt_args(stmt) - v_ptr, = args # FIXME: it's unsafe to call repeatedly, or on the wrong memory region @@ -1158,12 +1118,10 @@ class CPython(Facet): return [Transition(self.state, s_new, desc)] - def impl_PyMem_Malloc(self, stmt): + def impl_PyMem_Malloc(self, stmt, v_size): # http://docs.python.org/c-api/memory.html#PyMem_Malloc fnname = 'PyMem_Malloc' returntype = stmt.fn.type.dereference.type - args = self.state.eval_stmt_args(stmt) - v_size, = args r_nonnull = self.state.make_heap_region('PyMem_Malloc', stmt) v_nonnull = PointerToRegion(returntype, stmt.loc, r_nonnull) # FIXME: it hasn't been initialized @@ -1178,7 +1136,7 @@ class CPython(Facet): ######################################################################## # PyModule_* ######################################################################## - def impl_PyModule_AddIntConstant(self, stmt): + def impl_PyModule_AddIntConstant(self, stmt, v_module, v_name, v_value): # http://docs.python.org/c-api/module.html#PyModule_AddIntConstant # (No externally-visible refcount changes) @@ -1190,11 +1148,10 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyModule_AddObject(self, stmt): + def impl_PyModule_AddObject(self, stmt, v_module, v_name, v_value): # Steals a reference to the object if if succeeds: # http://docs.python.org/c-api/module.html#PyModule_AddObject # Implemented in Python/modsupport.c - v_module, v_name, v_value = self.state.eval_stmt_args(stmt) # On success, steals a ref from v_value: s_success = self.state.mkstate_concrete_return_of(stmt, 0) @@ -1206,7 +1163,7 @@ class CPython(Facet): return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyModule_AddStringConstant(self, stmt): + def impl_PyModule_AddStringConstant(self, stmt, v_module, v_name, v_value): # http://docs.python.org/c-api/module.html#PyModule_AddStringConstant # (No externally-visible refcount changes) @@ -1221,11 +1178,10 @@ class CPython(Facet): ######################################################################## # PyObject_* ######################################################################## - def impl_PyObject_HasAttrString(self, stmt): + def impl_PyObject_HasAttrString(self, stmt, v_o, v_attr_name): # http://docs.python.org/c-api/object.html#PyObject_HasAttrString fnname = stmt.fn.operand.name - v_o, v_attr_name = self.state.eval_stmt_args(stmt) # the object must be non-NULL: it is unconditionally # dereferenced to get the ob_type: @@ -1244,7 +1200,7 @@ class CPython(Facet): return [Transition(self.state, s_true, '%s() returns 1 (true)' % fnname), Transition(self.state, s_false, '%s() returns 0 (false)' % fnname)] - def impl_PyObject_IsTrue(self, stmt): + def impl_PyObject_IsTrue(self, stmt, v_o): # http://docs.python.org/c-api/object.html#PyObject_IsTrue s_true = self.state.mkstate_concrete_return_of(stmt, 1) s_false = self.state.mkstate_concrete_return_of(stmt, 0) @@ -1256,7 +1212,7 @@ class CPython(Facet): Transition(self.state, s_false, '%s() returns 0 (false)' % fnname), Transition(self.state, s_failure, '%s() returns -1 (failure)' % fnname)] - def impl__PyObject_New(self, stmt): + def impl__PyObject_New(self, stmt, tp_rvalue): # Declaration in objimpl.h: # PyAPI_FUNC(PyObject *) _PyObject_New(PyTypeObject *); # @@ -1270,8 +1226,6 @@ class CPython(Facet): assert isinstance(stmt, gcc.GimpleCall) assert isinstance(stmt.fn.operand, gcc.FunctionDecl) - tp_rvalue = self.state.eval_rvalue(stmt.args[0], stmt.loc) - # Success case: allocation and assignment: s_success, nonnull = self.mkstate_new_ref(stmt, '_PyObject_New') # ...and set up ob_type on the result object: @@ -1287,7 +1241,7 @@ class CPython(Facet): t_failure.dest.cpython.set_exception('PyExc_MemoryError', stmt.loc) return [t_success, t_failure] - def impl_PyObject_Repr(self, stmt): + def impl_PyObject_Repr(self, stmt, v_o): # Declared in object.h as: # PyAPI_FUNC(PyObject *) PyObject_Repr(PyObject *); # Docs: @@ -1296,7 +1250,7 @@ class CPython(Facet): 'PyStringObject', 'PyString_Type') return [t_success, t_failure] - def impl_PyObject_Str(self, stmt): + def impl_PyObject_Str(self, stmt, v_o): # Declared in object.h as: # PyAPI_FUNC(PyObject *) PyObject_Str(PyObject *); # also with: @@ -1308,7 +1262,8 @@ class CPython(Facet): ######################################################################## # PyRun_* ######################################################################## - def impl_PyRun_SimpleFileExFlags(self, stmt): + def impl_PyRun_SimpleFileExFlags(self, stmt, v_fp, v_filename, + v_closeit, v_flags): # http://docs.python.org/c-api/veryhigh.html#PyRun_SimpleFileExFlags s_success = self.state.mkstate_concrete_return_of(stmt, 0) s_failure = self.state.mkstate_concrete_return_of(stmt, -1) @@ -1316,7 +1271,7 @@ class CPython(Facet): # (FIXME: handle the potential autoclosing of the FILE*) return self.state.make_transitions_for_fncall(stmt, s_success, s_failure) - def impl_PyRun_SimpleStringFlags(self, stmt): + def impl_PyRun_SimpleStringFlags(self, stmt, v_command, v_flags): # http://docs.python.org/c-api/veryhigh.html#PyRun_SimpleStringFlags s_success = self.state.mkstate_concrete_return_of(stmt, 0) s_failure = self.state.mkstate_concrete_return_of(stmt, -1) @@ -1326,7 +1281,7 @@ class CPython(Facet): ######################################################################## # PyString_* ######################################################################## - def impl_PyString_AsString(self, stmt): + def impl_PyString_AsString(self, stmt, v_op): # Declared in stringobject.h as: # PyAPI_FUNC(char *) PyString_AsString(PyObject *); # Implemented in Objects/stringobject.c @@ -1337,8 +1292,6 @@ class CPython(Facet): # ((PyStringObject *)op) -> ob_sval # With other classes, this call can fail - v_op, = self.state.eval_stmt_args(stmt) - # It will segfault if called with NULL, since it uses PyString_Check, # which reads through the object's ob_type: self.state.raise_any_null_ptr_func_arg(stmt, 0, v_op) @@ -1368,7 +1321,7 @@ class CPython(Facet): t_failure.dest.cpython.set_exception('PyExc_MemoryError', stmt.loc) return [t_success, t_failure] - def impl_PyString_FromFormat(self, stmt): + def impl_PyString_FromFormat(self, stmt, v_fmt, *v_args): # Declared in stringobject.h as: # PyAPI_FUNC(PyObject *) PyString_FromFormat(const char*, ...) # Py_GCC_ATTRIBUTE((format(printf, 1, 2))); @@ -1381,13 +1334,12 @@ class CPython(Facet): 'PyStringObject', 'PyString_Type') return [t_success, t_failure] - def impl_PyString_FromString(self, stmt): + def impl_PyString_FromString(self, stmt, v_str): # Declared in stringobject.h as: # PyAPI_FUNC(PyObject *) PyString_FromString(const char *); # # http://docs.python.org/c-api/string.html#PyString_FromString # - v_str, = self.state.eval_stmt_args(stmt) # The input _must_ be non-NULL; it is not checked: self.state.raise_any_null_ptr_func_arg(stmt, 0, v_str) @@ -1396,7 +1348,7 @@ class CPython(Facet): 'PyStringObject', 'PyString_Type') return [t_success, t_failure] - def impl_PyString_FromStringAndSize(self, stmt): + def impl_PyString_FromStringAndSize(self, stmt, v_str, v_size): # Declared in stringobject.h as: # PyAPI_FUNC(PyObject *) PyString_FromStringAndSize(const char *, Py_ssize_t); # @@ -1416,14 +1368,14 @@ class CPython(Facet): ######################################################################## # PyStructSequence_* ######################################################################## - def impl_PyStructSequence_InitType(self, stmt): + def impl_PyStructSequence_InitType(self, stmt, v_type, v_desc): # void PyStructSequence_InitType(PyTypeObject *type, PyStructSequence_Desc *desc) # # Implemented in Objects/structseq.c # For now, treat it as a no-op: return [self.state.mktrans_nop(stmt, 'PyStructSequence_InitType')] - def impl_PyStructSequence_New(self, stmt): + def impl_PyStructSequence_New(self, stmt, tp_rvalue): # Declared in structseq.h as: # PyAPI_FUNC(PyObject *) PyStructSequence_New(PyTypeObject* type); # @@ -1433,8 +1385,6 @@ class CPython(Facet): assert isinstance(stmt, gcc.GimpleCall) assert isinstance(stmt.fn.operand, gcc.FunctionDecl) - tp_rvalue = self.state.eval_rvalue(stmt.args[0], stmt.loc) - # Success case: allocation and assignment: s_success, nonnull = self.mkstate_new_ref(stmt, 'PyStructSequence_New') # ...and set up ob_type on the result object: @@ -1453,7 +1403,7 @@ class CPython(Facet): ######################################################################## # PySys_* ######################################################################## - def impl_PySys_SetObject(self, stmt): + def impl_PySys_SetObject(self, stmt, v_name, v_value): # Declated in sysmodule.h # Defined in Python/sysmodule.c: # int PySys_SetObject(char *name, PyObject *v) @@ -1464,8 +1414,6 @@ class CPython(Facet): # on non-NULL, which adds a ref on it fnname = 'PySys_SetObject' returntype = stmt.fn.type.dereference.type - args = self.state.eval_stmt_args(stmt) - v_name, v_value = args t_success = self.state.mktrans_assignment(stmt.lhs, ConcreteValue(returntype, stmt.loc, 0), '%s() succeeds' % fnname) @@ -1480,9 +1428,8 @@ class CPython(Facet): ######################################################################## # PyTuple_* ######################################################################## - def impl_PyTuple_New(self, stmt): + def impl_PyTuple_New(self, stmt, v_len): # http://docs.python.org/c-api/tuple.html#PyTuple_New - v_len = self.state.eval_rvalue(stmt.args[0], stmt.loc) newobj, t_success, t_failure = self.impl_object_ctor(stmt, 'PyTupleObject', 'PyTuple_Type') @@ -1491,13 +1438,11 @@ class CPython(Facet): t_success.dest.value_for_region[r_ob_size] = v_len return [t_success, t_failure] - def impl_PyTuple_Size(self, stmt): + def impl_PyTuple_Size(self, stmt, v_op): # http://docs.python.org/c-api/tuple.html#PyTuple_Size # Implemented in Objects/tupleobject.c fnname = 'PyTuple_Size' returntype = stmt.fn.type.dereference.type - args = self.state.eval_stmt_args(stmt) - v_op = args[0] # The CPython implementation uses PyTuple_Check, which uses # Py_TYPE(op), an unchecked read through the ptr: @@ -1527,19 +1472,15 @@ class CPython(Facet): ######################################################################## # PyType_* ######################################################################## - def impl_PyType_IsSubtype(self, stmt): + def impl_PyType_IsSubtype(self, stmt, v_a, v_b): # http://docs.python.org/dev/c-api/type.html#PyType_IsSubtype - args = self.state.eval_stmt_args(stmt) - v_a, v_b = args returntype = stmt.fn.type.dereference.type return [self.state.mktrans_assignment(stmt.lhs, UnknownValue(returntype, stmt.loc), None)] - def impl_PyType_Ready(self, stmt): + def impl_PyType_Ready(self, stmt, v_type): # http://docs.python.org/dev/c-api/type.html#PyType_Ready - args = self.state.eval_stmt_args(stmt) - v_type = args[0] s_success = self.state.mkstate_concrete_return_of(stmt, 0) s_failure = self.state.mkstate_concrete_return_of(stmt, -1)

1 0

[gcc-python-plugin] cpychecker: remove dead code ("owned_refs" field of MyState)
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit 696dc649db2ea7d8f05814e902ea5ac000a2e7a6 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Fri Sep 23 19:00:56 2011 -0400 cpychecker: remove dead code ("owned_refs" field of MyState) The "owned_refs" field of MyState and the related methods were remnants of an early attempt at reference-count tracking, but haven't been used in a long time: remove them. The MyState.mktrans_assignment() overridden method is removed; the base State.mktrans_assignment() does all we need. libcpychecker/absinterp.py | 5 ----- libcpychecker/refcounts.py | 24 +----------------------- 2 files changed, 1 insertions(+), 28 deletions(-) --- diff --git a/libcpychecker/absinterp.py b/libcpychecker/absinterp.py index 9025ef9..daa598b 100644 --- a/libcpychecker/absinterp.py +++ b/libcpychecker/absinterp.py @@ -946,9 +946,6 @@ class Trace: def return_value(self): return self.states[-1].return_rvalue - def final_references(self): - return self.states[-1].owned_refs - def has_looped(self): """ Is the tail state of the Trace at a location where it's been before? @@ -1035,7 +1032,6 @@ def iter_traces(fun, stateclass, prefix=None, limits=None): prefix = Trace() curstate = stateclass(Location.get_block_start(fun.cfg.entry), None, None, None, - [], Resources(), ConcreteValue(get_PyObjectPtr(), fun.start, 0)) curstate.init_for_function(fun) @@ -1127,7 +1123,6 @@ class StateGraph: # Recursively gather states: initial = stateclass(Location.get_block_start(fun.cfg.entry), None, None, None, - [], Resources(), ConcreteValue(get_PyObjectPtr(), fun.start, 0)) initial.init_for_function(fun) diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 8a3af47..2941cd5 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -191,9 +191,8 @@ class GenericTpDealloc(AbstractValue): return [Transition(state, new, desc)] class MyState(State): - def __init__(self, loc, region_for_var, value_for_region, return_rvalue, owned_refs, resources, exception_rvalue): + def __init__(self, loc, region_for_var, value_for_region, return_rvalue, resources, exception_rvalue): State.__init__(self, loc, region_for_var, value_for_region, return_rvalue) - self.owned_refs = owned_refs self.resources = resources self.exception_rvalue = exception_rvalue @@ -202,16 +201,12 @@ class MyState(State): self.region_for_var.copy(), self.value_for_region.copy(), self.return_rvalue, - self.owned_refs[:], self.resources.copy(), self.exception_rvalue) if hasattr(self, 'fun'): c.fun = self.fun return c - def _extra(self): - return ' %s' % self.owned_refs - def acquire(self, resource): self.resources.acquire(resource) @@ -248,14 +243,6 @@ class MyState(State): typeobjregion) self.verify() - def mktrans_assignment(self, key, value, desc, additional_ptr=None): - if desc: - check_isinstance(desc, str) - transition = State.mktrans_assignment(self, key, value, desc) - if additional_ptr: - transition.dest.owned_refs.append(additional_ptr) - return transition - def get_transitions(self): # Return a list of Transition instances, based on input State stmt = self.loc.get_stmt() @@ -2037,15 +2024,6 @@ class MyState(State): raise ReadFromDeallocatedMemory(stmt, value) nextstate = self.use_next_loc() - """ - if isinstance(stmt.lhs, gcc.MemRef): - log('value: %s %r', value, value) - # We're writing a value to memory; if it's a PyObject* - # then we're surrending a reference on it: - if value in nextstate.owned_refs: - log('removing ownership of %s', value) - nextstate.owned_refs.remove(value) - """ return [self.mktrans_assignment(stmt.lhs, value, None)]

1 0

[gcc-python-plugin] cpychecker: implement PyErr_Occurred and PyInt_AsLong
by David Hugh Malcolm 24 Sep '11

24 Sep '11

commit b28d92ee0b4da0bf68c2f3ee63051be6e55090e2 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Fri Sep 23 18:46:52 2011 -0400 cpychecker: implement PyErr_Occurred and PyInt_AsLong Implement PyErr_Occurred and PyInt_AsLong (the selftests for PyInt_AsLong required PyErr_Occurred) Also, propagate the value in PyInt_FromLong within ob_ival, so it round-trips through a subsequent call to PyInt_AsLong. libcpychecker/refcounts.py | 60 +++++++++++++++- .../PyInt_AsLong/correct_PyIntObject/input.c | 54 +++++++++++++++ .../PyInt_AsLong/correct_PyIntObject/script.py | 22 ++++++ .../PyInt_AsLong/correct_PyIntObject/stdout.txt | 23 ++++++ .../refcounts/PyInt_AsLong/correct_cast/input.c | 62 +++++++++++++++++ .../refcounts/PyInt_AsLong/correct_cast/script.py | 22 ++++++ .../refcounts/PyInt_AsLong/correct_cast/stdout.txt | 72 ++++++++++++++++++++ 7 files changed, 311 insertions(+), 4 deletions(-) --- diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 82914b0..8a3af47 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -894,6 +894,19 @@ class MyState(State): t_next.dest.set_exception('PyExc_MemoryError', stmt.loc) return [t_next] + def impl_PyErr_Occurred(self, stmt): + # Declared in pyerrors.h: + # PyAPI_FUNC(PyObject *) PyErr_Occurred(void); + # + # Defined in Python/errors.c + # + # http://docs.python.org/c-api/exceptions.html#PyErr_Occurred + # Returns a borrowed reference; can't fail: + t_next = self.mktrans_assignment(stmt.lhs, + self.exception_rvalue, + 'PyErr_Occurred()') + return [t_next] + def impl_PyErr_Print(self, stmt): # Declared in pythonrun.h: # PyAPI_FUNC(void) PyErr_Print(void); @@ -1024,6 +1037,41 @@ class MyState(State): ######################################################################## # Py_Int* ######################################################################## + def impl_PyInt_AsLong(self, stmt): + # Declared in intobject.h as: + # PyAPI_FUNC(long) PyInt_AsLong(PyObject *); + # Defined in Objects/intobject.c + # + # http://docs.python.org/c-api/int.html#PyInt_AsLong + + # Can fail (gracefully) with NULL, and with non-int objects + + args = self.eval_stmt_args(stmt) + v_op = args[0] + + returntype = stmt.fn.type.dereference.type + + if self.object_ptr_has_global_ob_type(v_op, 'PyInt_Type'): + # We know it's a PyIntObject; the call will succeed: + # FIXME: cast: + v_ob_ival = self.get_value_of_field_by_region(v_op.region, + 'ob_ival') + t_success = self.mktrans_assignment(stmt.lhs, + v_ob_ival, + 'PyInt_AsLong() returns ob_ival') + return [t_success] + + # We don't know if it's a PyIntObject (or subclass); the call could + # fail: + t_success = self.mktrans_assignment(stmt.lhs, + UnknownValue(returntype, stmt.loc), + 'PyInt_AsLong() succeeds') + t_failure = self.mktrans_assignment(stmt.lhs, + ConcreteValue(returntype, stmt.loc, -1), + 'PyInt_AsLong() fails') + t_failure.dest.set_exception('PyExc_MemoryError', stmt.loc) + return [t_success, t_failure] + def impl_PyInt_FromLong(self, stmt): # Declared in intobject.h as: # PyAPI_FUNC(PyObject *) PyInt_FromLong(long); @@ -1038,14 +1086,18 @@ class MyState(State): args = self.eval_stmt_args(stmt) v_ival = args[0] - newobj, success, failure = self.impl_object_ctor(stmt, - 'PyIntObject', 'PyInt_Type') + newobj, t_success, t_failure = self.impl_object_ctor(stmt, + 'PyIntObject', 'PyInt_Type') + # Set ob_size: + r_ob_size = t_success.dest.make_field_region(newobj, 'ob_ival') + t_success.dest.value_for_region[r_ob_size] = v_ival + if isinstance(v_ival, ConcreteValue): if v_ival.value >= -5 and v_ival.value < 257: # We know that failure isn't possible: - return [success] + return [t_success] - return [success, failure] + return [t_success, t_failure] ######################################################################## # PyList_* diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c new file mode 100644 index 0000000..c86c0ca --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c @@ -0,0 +1,54 @@ +/* + Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> + Copyright 2011 Red Hat, Inc. + + This is free software: you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see + <http://www.gnu.org/licenses/>. +*/ + +#include <Python.h> + +/* + Test that PyInt_AsLong works for the case where we know it's a PyIntObject +*/ + +extern void __cpychecker_dump(long val); + +PyObject * +test(PyObject *self, PyObject *args) +{ + PyObject *int_obj; + long long_val; + + /* This call can't fail, since we're in the interval [-5..257) */ + int_obj = PyInt_FromLong(42); + + /* Verify that we can roundtrip the underlying int: */ + long_val = PyInt_AsLong(int_obj); + __cpychecker_dump(long_val); + + return int_obj; +} +static PyMethodDef test_methods[] = { + {"test_method", test, METH_VARARGS, NULL}, + {NULL, NULL, 0, NULL} /* Sentinel */ +}; + +/* + PEP-7 +Local variables: +c-basic-offset: 4 +indent-tabs-mode: nil +End: +*/ diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/script.py b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/script.py new file mode 100644 index 0000000..fdd5ba3 --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/script.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +# Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> +# Copyright 2011 Red Hat, Inc. +# +# This is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +from libcpychecker import main +main(verify_refcounting=True, + dump_traces=True, + show_traces=False) diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/stdout.txt b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/stdout.txt new file mode 100644 index 0000000..462d8e4 --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/stdout.txt @@ -0,0 +1,23 @@ +Trace 0: + Transitions: + 'PyInt_FromLong() succeeds' + 'PyInt_AsLong() returns ob_ival' + '__dump((long int)42 from tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c:35)' + 'returning' + Return value: + repr(): PointerToRegion(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=35), region=RegionOnHeap('PyIntObject', gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=35))) + str(): (struct PyObject *)&RegionOnHeap('PyIntObject', gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=35)) from tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c:35 + r->ob_refcnt: refs: 1 + N where N >= 0 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=35), region=RegionForGlobal(gcc.VarDecl('PyInt_Type'))) + Region("region-for-arg-gcc.ParmDecl('self')"): + repr(): Region("region-for-arg-gcc.ParmDecl('self')") + str(): Region("region-for-arg-gcc.ParmDecl('self')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=29), region=Region("region-for-type-of-arg-gcc.ParmDecl('self')")) + Region("region-for-arg-gcc.ParmDecl('args')"): + repr(): Region("region-for-arg-gcc.ParmDecl('args')") + str(): Region("region-for-arg-gcc.ParmDecl('args')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c', line=29), region=Region("region-for-type-of-arg-gcc.ParmDecl('args')")) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/PyInt_AsLong/correct_PyIntObject/input.c:30 diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c new file mode 100644 index 0000000..7e5bf62 --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c @@ -0,0 +1,62 @@ +/* + Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> + Copyright 2011 Red Hat, Inc. + + This is free software: you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see + <http://www.gnu.org/licenses/>. +*/ + +#include <Python.h> + +/* + Test that PyInt_AsLong works for the case where we don't know if it's + a PyIntObject +*/ + +extern void __cpychecker_dump(long val); + +PyObject * +test(PyObject *self, PyObject *args) +{ + long long_val; + + long_val = PyInt_AsLong(self); + if (-1 == long_val) { + if (PyErr_Occurred()) { + /* Unsuccessful coercion to "long": */ + return NULL; + } else { + /* Successful coercion to "long"; + it just happened to be -1: */ + __cpychecker_dump(long_val); + } + } else { + /* Successful coercion to "long": */ + __cpychecker_dump(long_val); + } + + Py_RETURN_NONE; +} +static PyMethodDef test_methods[] = { + {"test_method", test, METH_VARARGS, NULL}, + {NULL, NULL, 0, NULL} /* Sentinel */ +}; + +/* + PEP-7 +Local variables: +c-basic-offset: 4 +indent-tabs-mode: nil +End: +*/ diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/script.py b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/script.py new file mode 100644 index 0000000..fdd5ba3 --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/script.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +# Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> +# Copyright 2011 Red Hat, Inc. +# +# This is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +from libcpychecker import main +main(verify_refcounting=True, + dump_traces=True, + show_traces=False) diff --git a/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/stdout.txt b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/stdout.txt new file mode 100644 index 0000000..30faf66 --- /dev/null +++ b/tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/stdout.txt @@ -0,0 +1,72 @@ +Trace 0: + Transitions: + 'PyInt_AsLong() succeeds' + 'taking True path' + 'PyErr_Occurred()' + 'taking False path' + '__dump(unknown long int from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:34)' + 'returning' + Return value: + repr(): PointerToRegion(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=49), region=RegionForGlobal(gcc.VarDecl('_Py_NoneStruct'))) + str(): (struct PyObject *)&RegionForGlobal(gcc.VarDecl('_Py_NoneStruct')) from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:49 + r->ob_refcnt: refs: 1 + N where N >= 1 + r->ob_type: None + Region("region-for-arg-gcc.ParmDecl('self')"): + repr(): Region("region-for-arg-gcc.ParmDecl('self')") + str(): Region("region-for-arg-gcc.ParmDecl('self')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('self')")) + Region("region-for-arg-gcc.ParmDecl('args')"): + repr(): Region("region-for-arg-gcc.ParmDecl('args')") + str(): Region("region-for-arg-gcc.ParmDecl('args')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('args')")) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:31 + +Trace 1: + Transitions: + 'PyInt_AsLong() succeeds' + 'taking False path' + '__dump(unknown long int from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:34)' + 'returning' + Return value: + repr(): PointerToRegion(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=49), region=RegionForGlobal(gcc.VarDecl('_Py_NoneStruct'))) + str(): (struct PyObject *)&RegionForGlobal(gcc.VarDecl('_Py_NoneStruct')) from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:49 + r->ob_refcnt: refs: 1 + N where N >= 1 + r->ob_type: None + Region("region-for-arg-gcc.ParmDecl('self')"): + repr(): Region("region-for-arg-gcc.ParmDecl('self')") + str(): Region("region-for-arg-gcc.ParmDecl('self')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('self')")) + Region("region-for-arg-gcc.ParmDecl('args')"): + repr(): Region("region-for-arg-gcc.ParmDecl('args')") + str(): Region("region-for-arg-gcc.ParmDecl('args')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('args')")) + Exception: + (struct PyObject *)0 from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:31 + +Trace 2: + Transitions: + 'PyInt_AsLong() fails' + 'taking True path' + 'PyErr_Occurred()' + 'taking True path' + 'returning' + Return value: + repr(): ConcreteValue(gcctype='struct PyObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=38), value=0) + str(): (struct PyObject *)0 from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:38 + Region("region-for-arg-gcc.ParmDecl('self')"): + repr(): Region("region-for-arg-gcc.ParmDecl('self')") + str(): Region("region-for-arg-gcc.ParmDecl('self')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('self')")) + Region("region-for-arg-gcc.ParmDecl('args')"): + repr(): Region("region-for-arg-gcc.ParmDecl('args')") + str(): Region("region-for-arg-gcc.ParmDecl('args')") + r->ob_refcnt: refs: 0 + N where N >= 1 + r->ob_type: PointerToRegion(gcctype='struct PyTypeObject *', loc=gcc.Location(file='tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c', line=30), region=Region("region-for-type-of-arg-gcc.ParmDecl('args')")) + Exception: + (struct PyObject *)&RegionForGlobal(gcc.VarDecl('PyExc_MemoryError')) from tests/cpychecker/refcounts/PyInt_AsLong/correct_cast/input.c:34

1 0

[gcc-python-plugin] cpychecker: implement bit-shifting operations
by David Hugh Malcolm 23 Sep '11

23 Sep '11

commit 4280be45a09445808050addc67b3e7d29ae0e8ca Author: David Malcolm <dmalcolm(a)redhat.com> Date: Fri Sep 23 17:15:53 2011 -0400 cpychecker: implement bit-shifting operations docs/tree.rst | 4 ++-- libcpychecker/refcounts.py | 18 ++++++++++++++++++ .../absinterp/arithmetic/correct/input.c | 4 ++++ .../absinterp/arithmetic/correct/stdout.txt | 4 ++-- 4 files changed, 26 insertions(+), 4 deletions(-) --- diff --git a/docs/tree.rst b/docs/tree.rst index f45d65c..a33339f 100644 --- a/docs/tree.rst +++ b/docs/tree.rst @@ -516,9 +516,9 @@ Binary Expressions Subclass C/C++ operators =================================== ====================== .. py:class:: gcc.LrotateExpr - .. py:class:: gcc.LshiftExpr + .. py:class:: gcc.LshiftExpr `<<`, `<<=` .. py:class:: gcc.RrotateExpr - .. py:class:: gcc.RshiftExpr + .. py:class:: gcc.RshiftExpr `>>`, `>>=` =================================== ====================== Bitwise binary expressions: diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 3a4420a..9dccb6e 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -1905,6 +1905,24 @@ class MyState(State): a.value ^ b.value) raise NotImplementedError("Don't know how to cope with bitwise-xor of\n %r\nand\n %rat %s" % (a, b, stmt.loc)) + elif stmt.exprcode == gcc.LshiftExpr: + a, b = self.eval_binop_args(stmt) + if isinstance(a, UnknownValue) or isinstance(b, UnknownValue): + return UnknownValue(stmt.lhs.type, stmt.loc) + if isinstance(a, ConcreteValue) and isinstance(b, ConcreteValue): + return ConcreteValue(stmt.lhs.type, stmt.loc, + a.value << b.value) + raise NotImplementedError("Don't know how to cope with left shift of of\n %r\nand\n %rat %s" + % (a, b, stmt.loc)) + elif stmt.exprcode == gcc.RshiftExpr: + a, b = self.eval_binop_args(stmt) + if isinstance(a, UnknownValue) or isinstance(b, UnknownValue): + return UnknownValue(stmt.lhs.type, stmt.loc) + if isinstance(a, ConcreteValue) and isinstance(b, ConcreteValue): + return ConcreteValue(stmt.lhs.type, stmt.loc, + a.value >> b.value) + raise NotImplementedError("Don't know how to cope with right shift of of\n %r\nand\n %rat %s" + % (a, b, stmt.loc)) elif stmt.exprcode == gcc.ComponentRef: return self.eval_rvalue(rhs[0], stmt.loc) elif stmt.exprcode == gcc.VarDecl: diff --git a/tests/cpychecker/absinterp/arithmetic/correct/input.c b/tests/cpychecker/absinterp/arithmetic/correct/input.c index 5bc319c..dedabbd 100644 --- a/tests/cpychecker/absinterp/arithmetic/correct/input.c +++ b/tests/cpychecker/absinterp/arithmetic/correct/input.c @@ -41,6 +41,10 @@ test(void) i &= 0xaaaa; i ^= 0xaaaa; + /* Bit shifting */ + i <<= 2; + i >>= 1; + return i; } diff --git a/tests/cpychecker/absinterp/arithmetic/correct/stdout.txt b/tests/cpychecker/absinterp/arithmetic/correct/stdout.txt index 1d42045..98a2d65 100644 --- a/tests/cpychecker/absinterp/arithmetic/correct/stdout.txt +++ b/tests/cpychecker/absinterp/arithmetic/correct/stdout.txt @@ -2,7 +2,7 @@ Trace 0: Transitions: 'returning' Return value: - repr(): ConcreteValue(gcctype='int', loc=gcc.Location(file='tests/cpychecker/absinterp/arithmetic/correct/input.c', line=42), value=2570) - str(): (int)2570 from tests/cpychecker/absinterp/arithmetic/correct/input.c:42 + repr(): ConcreteValue(gcctype='int', loc=gcc.Location(file='tests/cpychecker/absinterp/arithmetic/correct/input.c', line=46), value=5140) + str(): (int)5140 from tests/cpychecker/absinterp/arithmetic/correct/input.c:46 Exception: (struct PyObject *)0 from tests/cpychecker/absinterp/arithmetic/correct/input.c:30

1 0

[gcc-python-plugin] cpychecker: bulletproof against combinatorial explosion
by David Hugh Malcolm 23 Sep '11

23 Sep '11

commit d667b9ed430f9df5f4c65fa977a4a30091573101 Author: David Malcolm <dmalcolm(a)redhat.com> Date: Fri Sep 23 16:38:43 2011 -0400 cpychecker: bulletproof against combinatorial explosion Introduce a Limits class to track how much work we've done analysing a particular function, and give up if the trace tree becomes larger than a certain number of transitions (hardcoded as 1024 for now). The selftest for this takes a few seconds on my laptop (before it gives up) libcpychecker/absinterp.py | 28 ++++- libcpychecker/refcounts.py | 8 +- run-test-suite.py | 10 ++- .../refcounts/combinatorial-explosion/input.c | 153 ++++++++++++++++++++ .../refcounts/combinatorial-explosion/script.py | 22 +++ .../refcounts/combinatorial-explosion/stderr.txt | 2 + 6 files changed, 219 insertions(+), 4 deletions(-) --- diff --git a/libcpychecker/absinterp.py b/libcpychecker/absinterp.py index 2f8bbf7..9025ef9 100644 --- a/libcpychecker/absinterp.py +++ b/libcpychecker/absinterp.py @@ -1003,7 +1003,26 @@ class Resources: logger('acquisitions: %s' % self._acquisitions) logger('releases: %s' % self._releases) -def iter_traces(fun, stateclass, prefix=None): +class TooComplicated(Exception): + """ + The function is too complicated for the checker to analyze. + """ + pass + +class Limits: + """ + Resource limits, to avoid an analysis going out of control + """ + def __init__(self, maxtrans): + self.maxtrans = maxtrans + self.trans_seen = 0 + + def on_transition(self, transition): + self.trans_seen += 1 + if self.trans_seen > self.maxtrans: + raise TooComplicated() + +def iter_traces(fun, stateclass, prefix=None, limits=None): """ Traverse the tree of traces of program state, returning a list of Trace instances. @@ -1074,8 +1093,13 @@ def iter_traces(fun, stateclass, prefix=None): check_isinstance(transition, Transition) transition.dest.verify() + if limits: + limits.on_transition(transition) + + newprefix = prefix.copy().add(transition) + # Recurse: - for trace in iter_traces(fun, stateclass, prefix.copy().add(transition)): + for trace in iter_traces(fun, stateclass, newprefix, limits): result.append(trace) return result else: diff --git a/libcpychecker/refcounts.py b/libcpychecker/refcounts.py index 6f6fd96..3a4420a 100644 --- a/libcpychecker/refcounts.py +++ b/libcpychecker/refcounts.py @@ -2272,7 +2272,13 @@ def check_refcounts(fun, dump_traces=False, show_traces=False, # print(dot) invoke_dot(dot) - traces = iter_traces(fun, MyState) + try: + traces = iter_traces(fun, MyState, limits=Limits(maxtrans=1024)) + except TooComplicated: + gcc.inform(fun.start, + 'this function is too complicated for the reference-count checker to analyze') + return + if dump_traces: traces = list(traces) dump_traces_to_stdout(traces) diff --git a/run-test-suite.py b/run-test-suite.py index 8ec682b..b50bbce 100644 --- a/run-test-suite.py +++ b/run-test-suite.py @@ -181,8 +181,16 @@ def run_test(testdir): #print 'err: %r' % err.actual c = p.wait() + expsuccess = (err.expdata == '') + + # Special case: + if testdir == 'tests/cpychecker/refcounts/combinatorial-explosion': + # This test case should succeed, whilst emitting a note on stderr; + # don't treat the stderr output as leading to an expected failure: + expsuccess = True + # Check exit code: - if err.expdata == '': + if expsuccess: # Expect a successful exit: if c != 0: raise CompilationError(out.actual, err.actual, p, args) diff --git a/tests/cpychecker/refcounts/combinatorial-explosion/input.c b/tests/cpychecker/refcounts/combinatorial-explosion/input.c new file mode 100644 index 0000000..9476a16 --- /dev/null +++ b/tests/cpychecker/refcounts/combinatorial-explosion/input.c @@ -0,0 +1,153 @@ +/* + Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> + Copyright 2011 Red Hat, Inc. + + This is free software: you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see + <http://www.gnu.org/licenses/>. +*/ + +#include <Python.h> + +/* + Verify that the refcount checker can cope with a combinatorial explosion + + Each function call below can have two possible outcomes on the refcount + of the object. +*/ + +PyObject * +test_adding_module_objects(PyObject *m) +{ + PyObject *item = PyString_FromString("foo"); + if (!item) { + return NULL; + } + + /* + Each of these function calls steals a reference to the object if it + succeeds, but can fail. + + Hence the expected ereference count can change at each function call, so + that (in theory) there are 2^N possible outcomes. + + The point of the test is to verify that the checker doesn't take O(2^N) + time for such a case. + */ + + Py_INCREF(item); + PyModule_AddObject(m, "item_001", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_002", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_003", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_004", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_005", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_006", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_007", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_008", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_009", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_010", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_011", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_012", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_013", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_014", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_015", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_016", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_017", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_018", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_019", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_020", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_021", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_022", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_023", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_024", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_025", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_026", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_027", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_028", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_029", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_030", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_031", item); + + Py_INCREF(item); + PyModule_AddObject(m, "item_032", item); + + return item; +} + +/* + PEP-7 +Local variables: +c-basic-offset: 4 +indent-tabs-mode: nil +End: +*/ diff --git a/tests/cpychecker/refcounts/combinatorial-explosion/script.py b/tests/cpychecker/refcounts/combinatorial-explosion/script.py new file mode 100644 index 0000000..fdd5ba3 --- /dev/null +++ b/tests/cpychecker/refcounts/combinatorial-explosion/script.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +# Copyright 2011 David Malcolm <dmalcolm(a)redhat.com> +# Copyright 2011 Red Hat, Inc. +# +# This is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +from libcpychecker import main +main(verify_refcounting=True, + dump_traces=True, + show_traces=False) diff --git a/tests/cpychecker/refcounts/combinatorial-explosion/stderr.txt b/tests/cpychecker/refcounts/combinatorial-explosion/stderr.txt new file mode 100644 index 0000000..31a9f86 --- /dev/null +++ b/tests/cpychecker/refcounts/combinatorial-explosion/stderr.txt @@ -0,0 +1,2 @@ +tests/cpychecker/refcounts/combinatorial-explosion/input.c: In function 'test_adding_module_objects': +tests/cpychecker/refcounts/combinatorial-explosion/input.c:31:1: note: this function is too complicated for the reference-count checker to analyze diff --git a/tests/cpychecker/refcounts/combinatorial-explosion/stdout.txt b/tests/cpychecker/refcounts/combinatorial-explosion/stdout.txt new file mode 100644 index 0000000..e69de29

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

gcc-python-plugin-commits September 2011