Crunching false positives

Author: dejo1307

internal/engine/cache.go

@@ -28,7 +28,10 @@ import (
 // v12: C/C++ macro-body scan also captures value-position function pointers (.field = fn / = &fn inside #define), e.g. ops tables defined via a macro.
 // v13: C/C++ in-extractor macro expansion of file-scope invocations recovers token-pasted callbacks (CONFIGFS_ATTR/DEVICE_ATTR_RO -> name##_show).
 // v14: C/C++ static single-arg DEVICE_ATTR/BUS_ATTR expansion, all-ident scan of expanded macros (DEFINE_SHOW_ATTRIBUTE), capitalized C callee resolution.
-const cacheVersion = "v14"
+// v15: C/C++ salvage function-pointer refs from file-scope ERROR regions (macro-opened structs like MACHINE_START/DT_MACHINE_START ... MACHINE_END).
+// v16: extend that salvage to file-scope assignment_expression/field_expression fragments (machine_desc blocks parse that way when surrounded by other code).
+// v17: full-tree salvage of `.field = fn` macro-struct debris (machine_desc) regardless of where tree-sitter scatters it (skips function bodies).
+const cacheVersion = "v17"
 
 // extractorCache holds per-extractor facts keyed by a content hash of the files
 // the extractor depends on. It is loaded from disk at the start of a snapshot and

internal/extractors/cppextractor/c_test.go

@@ -571,6 +571,40 @@ static int use(void) { return NE_PTR(3) + ARRAY_SIZE(buf); }
 	}
 }
 
+// TestCMachineDescErrorRegion covers the ARM machine_desc pattern: a struct opened
+// by a macro (DT_MACHINE_START) and closed by another (MACHINE_END), whose
+// `.field = fn` lines tree-sitter renders as a file-scope ERROR node. The callbacks
+// must be recovered.
+func TestCMachineDescErrorRegion(t *testing.T) {
+	// Two blocks after a declaration + a call-valued `.smp` field — the shape that
+	// makes tree-sitter recover the blocks as bare assignment_expression /
+	// field_expression fragments rather than one clean ERROR node.
+	ff := extractProject(t, map[string]string{
+		"src/board.c": `
+static void omap_reserve(void) {}
+static void omap_generic_init(void) {}
+static void omap2xxx_restart(void) {}
+static void mvebu_dt_init(void) {}
+static const char *const compat[] = { "x", 0 };
+DT_MACHINE_START(OMAP242X_DT, "Generic OMAP2420")
+	.smp		= smp_ops(omap_smp_ops),
+	.reserve	= omap_reserve,
+	.init_machine	= omap_generic_init,
+	.restart	= omap2xxx_restart,
+MACHINE_END
+DT_MACHINE_START(OMAP243X_DT, "Generic OMAP2430")
+	.init_machine	= mvebu_dt_init,
+MACHINE_END
+`,
+	})
+	mod := mustFact(t, ff, "src")
+	for _, fn := range []string{"src.omap_reserve", "src.omap_generic_init", "src.omap2xxx_restart", "src.mvebu_dt_init"} {
+		if !hasRelation(mod, facts.RelCalls, fn) {
+			t.Errorf("machine_desc callback %s should be referenced, got %+v", fn, mod.Relations)
+		}
+	}
+}
+
 // TestCArgRefNonFunctionDropped guards the funcNames filter: an argument identifier
 // that does not name a real function must NOT produce a RelCalls edge (otherwise a
 // data argument could spuriously mark a same-named function as used).

internal/extractors/cppextractor/cpp_ast.go

@@ -55,6 +55,9 @@ func extractFileAST(src []byte, relFile, lang string, macros macroTable) []facts
 		macros:         macros,
 	}
 	w.walkDeclList(tree.RootNode())
+	// Recover callbacks from macro-opened struct initializers (machine_desc), which
+	// tree-sitter can't parse and scatters as `.field = fn` assignment debris.
+	w.salvageMacroStructAssigns(tree.RootNode())
 	return w.out
 }
 
@@ -975,6 +978,43 @@ func (w *astWalker) expandMacroDeclaration(typ, declarator *sitter.Node) bool {
 	return true
 }
 
+// salvageMacroStructAssigns recovers function-pointer references from a
+// macro-opened struct initializer — `DT_MACHINE_START(...) .init_machine = fn, ...
+// MACHINE_END`. The hidden opening brace makes tree-sitter fail to parse the block;
+// depending on the surrounding code it renders the `.field = fn` lines as a chain
+// of `assignment_expression`s with a `field_expression` left side, scattered under
+// an ERROR node, a bare top-level expression, or a neighbouring declaration. Rather
+// than chase every recovery shape, walk the whole tree (skipping function bodies,
+// whose assignments walkForCalls already handles) and capture the RHS of every
+// `<field> = fn` assignment on the module owner. resolveFuncPtrRefs keeps only the
+// real functions, so this is generic (no hard-coded macro names) and safe.
+func (w *astWalker) salvageMacroStructAssigns(root *sitter.Node) {
+	var assigns []*sitter.Node
+	var walk func(n *sitter.Node)
+	walk = func(n *sitter.Node) {
+		if n == nil || n.Kind() == "function_definition" {
+			return
+		}
+		if n.Kind() == "assignment_expression" {
+			if l := n.ChildByFieldName("left"); l != nil && l.Kind() == "field_expression" {
+				assigns = append(assigns, n)
+			}
+		}
+		for i := uint(0); i < n.ChildCount(); i++ {
+			walk(n.Child(i))
+		}
+	}
+	walk(root)
+	if len(assigns) == 0 {
+		return
+	}
+	w.pushOwner(w.moduleOwner())
+	for _, a := range assigns {
+		w.emitAssignFuncPtrRef(a)
+	}
+	w.popOwner()
+}
+
 // handleMacroBodyCalls scans a #define replacement list (preproc_def /
 // preproc_function_def) for identifiers used as functions — in call position
 // (`IDENT(`) or value position (`= IDENT` / `.field = IDENT` / `= &IDENT`) — and

internal/extractors/cppextractor/probe_test.go

@@ -0,0 +1,40 @@
+package cppextractor
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	sitter "github.com/tree-sitter/go-tree-sitter"
+	c "github.com/tree-sitter/tree-sitter-c/bindings/go"
+)
+
+func TestProbeDa8xxTop(t *testing.T) {
+	for _, f := range []string{
+		"/Users/dejan/development/cpp/linux/arch/arm/mach-davinci/da8xx-dt.c",
+		"/Users/dejan/development/cpp/linux/arch/arm/mach-omap2/board-generic.c",
+	} {
+		src, err := os.ReadFile(f)
+		if err != nil {
+			t.Skip("no tree")
+		}
+		parser := sitter.NewParser()
+		_ = parser.SetLanguage(sitter.NewLanguage(c.Language()))
+		tree := parser.Parse(src, nil)
+		root := tree.RootNode()
+		fmt.Printf("=== %s ===\n", f)
+		for i := uint(0); i < root.ChildCount(); i++ {
+			ch := root.Child(i)
+			line := strings.SplitN(string(src[ch.StartByte():ch.EndByte()]), "\n", 2)[0]
+			if len(line) > 50 {
+				line = line[:50]
+			}
+			if strings.Contains(string(src[ch.StartByte():ch.EndByte()]), "MACHINE_START") || ch.Kind() == "ERROR" {
+				fmt.Printf("  [%d] %s | %q\n", ch.StartPosition().Row+1, ch.Kind(), line)
+			}
+		}
+		parser.Close()
+		tree.Close()
+	}
+}