Analyzer gains support for virtual function devirtualization.
The GCC analyzer can now devirtualize virtual function calls, improving analysis accuracy.
The GCC static analyzer has gained the ability to devirtualize virtual function calls, addressing a significant limitation. This patch introduces logic to resolve calls made through OBJ_TYPE_REF by utilizing vptr information to link calls to concrete subclass implementations. Additionally, can_throw_p has been enhanced to consider thunks and TREE_NOTHROW for more accurate exception analysis, particularly in multiple inheritance scenarios.
In Details
This commit enhances the GCC static analyzer's region-model.cc by enabling devirtualization of virtual function calls. It introduces get_fndecl_for_virtual_call to resolve calls based on the OBJ_TYPE_REF's vptr field, leveraging the existing store-binding mechanism. The can_throw_p function is also improved to correctly handle noexcept attributes and thunks in virtual method calls, especially in complex multiple inheritance setups. This directly addresses PR analyzer/97114.
- static analyzer
- A tool that analyzes source code without executing it to find potential bugs, vulnerabilities, or other issues. GCC's analyzer identifies undefined behavior and other problems.
- devirtualization
- The process of replacing a virtual function call with a direct function call. This is an optimization that can be performed by a static analyzer or a compiler if the target function can be determined at compile time.
- vptr
- Virtual function table pointer. A pointer within an object instance that points to the object's virtual function table (vtable), which in turn contains pointers to the correct virtual function implementations.
- thunk
- A small piece of code that bridges two other pieces of code. In C++, thunks are often used to adjust pointers or handle details in complex scenarios like multiple inheritance or virtual function calls.