analyzer: avoid deep-copying program_state when creating an exploded_node
GCC analyzer optimizes exploded_node creation by using move semantics, reducing deep-copy overhead.
GCC’s static analyzer now avoids deep-copying program_state when creating new exploded_nodes. By introducing move support for program_state, point_and_state, and exploded_node, the process of creating a new node is reduced from three deep copies to a single move operation, significantly improving performance.
In Details
The exploded_graph::get_or_create_node function previously performed multiple deep copies of program_state when creating a new exploded_node. This was inefficient as program_state owned its region_model and sm_state_map via pointers, leading to redundant cloning. This patch introduces move assignment for program_state and move constructors/overloads for point_and_state and exploded_node, changing the creation cost from three deep copies to one move operation. A copy of pruned_state is retained for use as a stable hash map key during merge operations.
- exploded_node
- A node in the exploded graph representation used by GCC's static analyzer. Each node represents a possible program state at a particular point in execution.
- program_state
- An internal data structure within GCC's static analyzer that encapsulates the state of the program being analyzed, including memory, registers, and other relevant information.
- deep copy
- Creating a completely independent copy of an object, including any objects it references. For objects managing dynamically allocated memory or complex data structures, a deep copy duplicates those as well.
- move semantics
- A C++ feature that allows resources (like dynamically allocated memory) to be efficiently transferred from one object to another, often by simply transferring ownership of pointers rather than copying the data itself. This is typically enabled by move constructors and move assignment operators.
- static analyzer
- A tool that analyzes source code to find potential errors or vulnerabilities without actually running the program. It examines the code's structure and control flow.
- region_model
- A data structure used within GCC's static analyzer to model memory regions and their properties.