Improvements to array bounds inference

[Machiry]

• Context-sensitive bounds:

  Consider the following example:

_Itype_for_any(T) void *somefunc(unsigned long size) : itype(_Array_ptr<T>) byte_count(size);
        
struct hash_node
{
  int *p_key;
  int *q_key;
  int *r_key;
  unsigned pqlen;
  unsigned r_len;
}; 
int foo() {
    unsigned i;
    struct hash_node *n ;
    i = 5*sizeof(int);
    n->pqlen = i;
    n->p_key = somefunc(i);
    n->r_key = somefunc(n->r_len);
    n->p_key[0] = 1;
    n->r_key[0] = 1;
    return 0;
}

Here, we need to keep track of the call-sites of somefunc. This allows us to keep track of the length association correctly.
That way, we can correctly infer the bounds as below:

struct hash_node
{
  _Array_ptr<int> p_key : count(pqlen);
  _Array_ptr<int> q_key : count(pqlen);
  _Array_ptr<int> r_key : count(r_len);
  unsigned pqlen;
  unsigned r_len;
}; 

• Prioritized Bounds:

  When we have conflicting bounds, use bounds based on priority:
  Example:

p = malloc(n*sizeof(int));
...
memcpy(p, q, 8);

In the above case, even though p has conflicting bounds from malloc and memcpy we will infer the bounds of p to be count(n).

• Invalidate bounds on pointer arithmetic:

  If there is pointer arithmetic on a pointer, then it cannot have count or byte_bounds.
  For example:

    _Array_ptr<int> p : count(n) = malloc(n*sizeof(int));
    ...
    ...
    p++;
  

The above bounds expressio for p ins invalid because count(n) means -> bounds(p, p+n) that means changing p (i.e., p++) will make the bounds invalid.
Ideally, we should do the following:

   _Ptr<int> pl = NULL;
   _Array_ptr<int> p : bounds(pl, pl+n) = malloc(n*sizeof(int));
   pl = p;

Making the above change is not straight forward. We will make another issue (enhancement) for that. As of now, we make the bounds invalid whenever we see a pointer modifying expression.

• Bounds for return values:

We will emit bounds for function returns.

For example:

        int *sus() {
           int *z = malloc(5*sizeof(int));
          ...
          return z;
       }

will get converted to:

       _Array_ptr<int> sus() : count(5) {
           _Array_ptr<int> z = malloc(5*sizeof(int));
          ...
          return z;
       }