[Cocci] Matching functions with attributes

[Cocci] Matching functions with attributes

[Eliseo Martínez]

Hi, 

>From what I?ve read, I understand attributes are not supported by coccinelle.
But I?m still wondering it there would be a way to perform a task I?d like to do: Checking whether functions marked as returning non-null are used in any place so that return value is checked for nullness/nonnullness.
So, this breaks into 2 subproblems:

1) Matching desired functions.

I know I can?t directly match functions having certain attributes.
But we don?t use attributes directly. We use some macros for that.
So, all functions I?d like to pick include the macro FUNC_ATTR_NONNULL_RET in their declaration/definition.
Then, would there be any way to match functions having the literal ?FUNC_ATTR_NONNULL_RET? in their declaration/definition?

2) Applying some rules for the same set of functions.

Up until now, I?ve done this by manually obtaining the list of desired functions, and then running this spatch:

```
@@ identifier func =~ "^(transstr|list_alloc|listitem_alloc|dict_alloc|dictitem_alloc|dictitem_copy|vim_strsave_fnameescape|ga_concat_strings|enc_canonize|reverse_text|get_tv_string|get_tv_string_buf|viminfo_readstring|ga_concat_strings_sep|xmalloc|xcalloc|xrealloc|xmallocz|xmemdupz|xstrchrnul|xmemscan|xstpcpy|xstpncpy|xstrdup|xstrndup|xmemdup|msg_show_console_dialog|home_replace_save|get_register|invocation_path_tail|concat_fnames|save_absolute_path|getroom|vim_strsave|vim_strnsave|vim_strsave_escaped|vim_strsave_escaped_ext|vim_strsave_shellescape|vim_strsave_up|vim_strnsave_up|strup_save|concat_str)$"; statement S; @@

(
* if (func(...) == NULL) S;
|
* if (func(...) != NULL) S;
)

@@ identifier func =~ "^(transstr|list_alloc|listitem_alloc|dict_alloc|dictitem_alloc|dictitem_copy|vim_strsave_fnameescape|ga_concat_strings|enc_canonize|reverse_text|get_tv_string|get_tv_string_buf|viminfo_readstring|ga_concat_strings_sep|xmalloc|xcalloc|xrealloc|xmallocz|xmemdupz|xstrchrnul|xmemscan|xstpcpy|xstpncpy|xstrdup|xstrndup|xmemdup|msg_show_console_dialog|home_replace_save|get_register|invocation_path_tail|concat_fnames|save_absolute_path|getroom|vim_strsave|vim_strnsave|vim_strsave_escaped|vim_strsave_escaped_ext|vim_strsave_shellescape|vim_strsave_up|vim_strnsave_up|strup_save|concat_str)$"; identifier var; statement S; expression E; @@

  var = func(...);
  ... when != var = E
(
* if (var == NULL) S;
|
* if (var != NULL) S;
)
```

As you see, I have to replicate the list. Is there any better way to achieve the same effect?

Thanks in advance.
Eliseo.

[Cocci] Matching functions with attributes

[SF Markus Elfring]

> Then, would there be any way to match functions having the
> literal ?FUNC_ATTR_NONNULL_RET? in their declaration/definition?

A preprocessor symbol like "NULL" or "ZERO_OR_NULL_PTR" can be found
at least.   ;-)

Would you like to try it out how many source code places can be found
with your macro name?


> @@ identifier func =~ "^(transstr|list_alloc|listitem_alloc| [...] |concat_str)$"; [...] @@
> 
>   var = func(...);
>   ... when != var = E
> (
> * if (var == NULL) S;
> |
> * if (var != NULL) S;
> )

Does this kind of SmPL disjunction make sense?


> ```
> 
> As you see, I have to replicate the list.

I would also appreciate if such repetition could be avoided for
SmPL constraints.


> Is there any better way to achieve the same effect?

How do you think about to construct the desired regular expression
by other programming scripts automatically?

Would you like to store involved function names into specific
data structures (like databases)?

Regards,
Markus

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> Then, would there be any way to match functions having the
>> literal ?FUNC_ATTR_NONNULL_RET? in their declaration/definition?
> 
> Would you like to try it out how many source code places can be found
> with your macro name?

This approach
``` 
@nonnullfuncs@ identifier func; @@

* func
  (...)
  ... FUNC_ATTR_NONNULL_RET ...
  {...}
```
matches nothing.

>> @@ identifier func =~ "^(transstr|list_alloc|listitem_alloc| [...] |concat_str)$"; [...] @@
>> 
>>  var = func(...);
>>  ... when != var = E
>> (
>> * if (var == NULL) S;
>> |
>> * if (var != NULL) S;
>> )
> 
> Does this kind of SmPL disjunction make sense?

I don?t see why not. AFAIK, Disjunctions can contain a full term (identifier/expression/statement).
Regarding meaning, well, I?m looking for places where var is checked for nullness/non-nullnes.
That?s the most obvious way I?ve found to express that?

>> As you see, I have to replicate the list.
>> 
> I would also appreciate if such repetition could be avoided for
> SmPL constraints.

I?ve tried with rule inheritance, but don?t know what to put in a first rule that just ?selects? the functions. This is:

```
@r@ identifier func =~ ??list of names? ? @@

  ? What here???

@@ identifier r.func @@

(
* if (func(?) == NULL) S;
|
* if (func(?) != NULL) S;
)
```

>> Is there any better way to achieve the same effect?
> 
> How do you think about to construct the desired regular expression
> by other programming scripts automatically?
> 
> Would you like to store involved function names into specific
> data structures (like databases)?

The purpose of my question is to see if there?s a way to do this within coccinelle.
If there?s no such a way, then, well, I?ll definitely consider constructing that regexp through some external script.

Thanks.

[Cocci] Matching functions with attributes

[SF Markus Elfring]

> Regarding meaning, well, I?m looking for places where var is checked for nullness/non-nullnes.
> That?s the most obvious way I?ve found to express that?

By the way:
Do you need to extend your source code search pattern with else clauses
for the shown if statements?


>> Would you like to store involved function names into specific
>> data structures (like databases)?
> 
> The purpose of my question is to see if there?s a way to do this within coccinelle.

It can become possible.

Would you like to help in improving the corresponding OCaml source files?


> If there?s no such a way, then, well, I?ll definitely consider constructing
> that regexp through some external script.

How do you think about to reuse any ideas from my approach for an other
semantic filter?

https://lkml.org/lkml/2014/3/5/356
http://article.gmane.org/gmane.comp.version-control.coccinelle/3513/
https://systeme.lip6.fr/pipermail/cocci/2014-March/000676.html

Regards,
Markus

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> Do you need to extend your source code search pattern with else clauses
> for the shown if statements?

I don?t think so. I?ll check that, though.

> Would you like to help in improving the corresponding OCaml source files?

Unfortunately, I?m not acquainted with OCaml yet.

Thanks.

[Cocci] Matching functions with attributes

[Julia Lawall]

On Wed, 21 Jan 2015, Eliseo Mart?nez wrote:

>
> > Then, would there be any way to match functions having the
> >> literal ?FUNC_ATTR_NONNULL_RET? in their declaration/definition?
> >
> > Would you like to try it out how many source code places can be found
> > with your macro name?
>
> This approach
> ```
> @nonnullfuncs@ identifier func; @@
>
> * func
>   (...)
>   ... FUNC_ATTR_NONNULL_RET ...
>   {...}
> ```
> matches nothing.

I'm surprised that it parses.  Matching of attributes is not supported.
Parsing them in C code is too (or at least very) difficult, and they are
all shifted into comments.

> >> @@ identifier func =~ "^(transstr|list_alloc|listitem_alloc| [...] |concat_str)$"; [...] @@
> >>
> >>  var = func(...);
> >>  ... when != var = E
> >> (
> >> * if (var == NULL) S;
> >> |
> >> * if (var != NULL) S;
> >> )
> >
> > Does this kind of SmPL disjunction make sense?

You don't want the semicolon after S.  That means a statement followed by
a semicolon, which could match something like x = 3;;, that is the
statement x = 3; followed by another semicolon.

Only use regular expressions if you absolutely have to.  They are not
interpreted when preselecting files, so they drasticaly hurt performance.

> I don?t see why not. AFAIK, Disjunctions can contain a full term
> (identifier/expression/statement). Regarding meaning, well, I?m looking
> for places where var is checked for nullness/non-nullnes. That?s the
> most obvious way I?ve found to express that?
>
> >> As you see, I have to replicate the list.
> >>
> > I would also appreciate if such repetition could be avoided for
> > SmPL constraints.
>
> I?ve tried with rule inheritance, but don?t know what to put in a first
> rule that just ?selects? the functions. This is:
>
> ```
> @r@ identifier func =~ ??list of names? ? @@
>
>   ? What here???
>
> @@ identifier r.func @@
>
> (
> * if (func(?) == NULL) S;
> |
> * if (func(?) != NULL) S;
> )
> ```

I'm not following the goal here.

julia

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> I'm not following the goal here.

I have a list of functions that I know can?t return NULL.
I want to look for places where after invoking one of those functions, returned value is (unnecessarily) checked for being null or non-null.

I have a working spatch now:
```
@@ identifier func =~ "^(vim_strsave|list_alloc)$"; statement S; @@

(
* if (func(...) == NULL)
    S
|
* if (func(...) != NULL)
    S
)

@@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var; statement S; expression E; @@

  var = func(...);
  ... when != var = E
(
* if (var == NULL)
    S
|
* if (var != NULL)
    S
)
```

That was basically my first approach in previous messages, but there were 2 minor issues:
- The extra semicolon you warned against. This is, I had to replace ?S;? with ?S?.
- A second, weird thing: 
    If I put ?S? on the same line as the ?if?, it finds nothing.
    If I put ?S? on a separated line, then it works.
    Is this a bug? I thought whitespace was never significant? 

[Cocci] Matching functions with attributes

[Julia Lawall]

On Wed, 21 Jan 2015, Eliseo Mart?nez wrote:

> > I'm not following the goal here.
>
> I have a list of functions that I know can?t return NULL.
> I want to look for places where after invoking one of those functions, returned value is (unnecessarily) checked for being null or non-null.
>
> I have a working spatch now:
> ```
> @@ identifier func =~ "^(vim_strsave|list_alloc)$"; statement S; @@
>
> (
> * if (func(...) == NULL)
>     S
> |
> * if (func(...) != NULL)
>     S
> )
>
> @@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var; statement S; expression E; @@
>
>   var = func(...);
>   ... when != var = E
> (
> * if (var == NULL)
>     S
> |
> * if (var != NULL)
>     S
> )
> ```
>
> That was basically my first approach in previous messages, but there were 2 minor issues:
> - The extra semicolon you warned against. This is, I had to replace ?S;? with ?S?.
> - A second, weird thing:
>     If I put ?S? on the same line as the ?if?, it finds nothing.
>     If I put ?S? on a separated line, then it works.
>     Is this a bug? I thought whitespace was never significant?

The difference would be whether the S is under the * or outside it.  But I
don't see why it would matter.  I will check.

If you replace your if by

if (x == NULL) S1 else S2

then it should catch everything, including the != case and the one branch
case.  This is due to various isomorphisms, as described in standard.iso.

julia

[Cocci] Matching functions with attributes

[SF Markus Elfring]

> I have a list of functions that I know can?t return NULL.

Such a function property can also be automatically determined
with semantic filter scripts to some degree (if you have got
access to corresponding source files).
How do you manage the knowledge for your function name list?

Regards,
Markus

[Cocci] Matching functions with attributes

[SF Markus Elfring]

> I have a working spatch now:
> ```
> @@ identifier func =~ "^(vim_strsave|list_alloc)$"; statement S; @@
>
> (
> * if (func(...) == NULL)
>     S

How much does the SmPL star functionality matter here for you?

Do you need to get the source code analysis results
also in other data formats like the following?
* Emacs org mode
* CSV file variant

Regards,
Markus

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> Can you give an example of some code in which you find a match?

Here they are some examples of code matched by

```
@@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var; statement S; expression E; @@

 var = func(...);
 ... when != var = E
(
* if (var == NULL)
   S
|
* if (var != NULL)
   S
)
```

but missed if we put S in the same line as ?if?.

```
      p = home_replace_save(NULL, files[i]);
*     if (p != NULL) {
        free(files[i]);
        files[i] = p;
      }
```

```
    p = vim_strsave(p);
    rettv->vval.v_string = p;
*   if (p != NULL)
      shorten_dir(p);
```

```
  if (temp_result != NULL && nextcmd == NULL) {
    retval = xmalloc(STRLEN(temp_result) + (expr_start - in_start)
                     + (in_end - expr_end) + 1);
    STRCPY(retval, in_start);
    STRCAT(retval, temp_result);
    STRCAT(retval, expr_end + 1);
  }
  free(temp_result);

  *in_end = c1;                 /* put char back for error messages */
  *expr_start = '{';
  *expr_end = '}';

* if (retval != NULL) {
    temp_result = find_name_end(retval, &expr_start, &expr_end, 0);
    if (expr_start != NULL) {
      /* Further expansion! */
      temp_result = make_expanded_name(retval, expr_start,
          expr_end, temp_result);
      free(retval);
      retval = temp_result;
    }
  }

```

This last case is a false positive, as retval can be null if we don?t enter the ?if? where it?s assigned. But it conforms to the specified spatch, so I add it as an example of more complex code matched by it.
So, when S is in a separated line, everything seems to work perfectly. I have 63 matches for that in my code.
If I put S in the same line as ?if?, then it finds 0 matches.

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> How do you manage the knowledge for your function name list?

I don?t manage it. 
When I first wanted to do this task of detecting unnecessary null checks, I thought I could match such functions through SmPL.
As it seemed to be impossible, then I extracted that list manually (grepping for FUNC_ATTR_NONNULL_RET).
Now, to automate that task for future retries of this task, I?m thinking about a vim-based solution (grepping into quicklist window, and execcuting a macro on each result to accumulate names in a variable).

> How much does the SmPL star functionality matter here for you?

Not sure I understand your question. Star functionality is crucial for me there, as I?m using this spatch to find spots in the code that I want to manually review.

> Do you need to get the source code analysis results also in other data formats?

No, at least by now. As I said, I?m using this patch just to get pointers to places in code I?d like to review.

[Cocci] Matching functions with attributes

[SF Markus Elfring]

>> Do you need to get the source code analysis results also in other data formats?
> No, at least by now. As I said, I?m using this patch just to get pointers to places in code I?d like to review.

Alternative presentation formats can also help you to find
interesting update candidates and position them in the preferred
software development environment.

Regards,
Markus

[Cocci] Matching functions with attributes

[Julia Lawall]

With the following source code:

int main() {
     p = home_replace(NULL, files[i]);
      if (p != NULL) {
        free(files[i]);
        files[i] = p;
      }
}

and the following semanticpatch:

@@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
statement S; expression E; @@

  var = func(...);
  ... when != var = E
* if (var != NULL)
    S

I get nothing.  If I remove the regular expression, then I get results
with the above semantic patch and with the following semantic partch:

@@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
statement S; expression E; @@

  var = func(...);
  ... when != var = E
* if (var != NULL)    S

Probably the issue inmy case is the kind of regular expression being used.
Are you using pcre?

julia

[Cocci] Matching functions with attributes

[Eliseo Martínez]

> I get nothing

Given that patch (which does not include ?home_replace? in the regex), that would be the expected result.
Note that I didn?t include the full list of functions in my last patch (not to make it more confusing than necessary), but the actual patch I?m using contains all functions, including ?home_replace?. 

In any case, I?ve just realized the problem could be not in spatch, but in how I?m parsing its output through vim?s errorformat.
So, please, forget about this by now, and sorry for the noise.
If I do isolate a real failure in spatch, I will get back to you with a complete set of patch/source to reproduce it.

Thanks.


> On 22 Jan 2015, at 12:52, Julia Lawall <julia.lawall@lip6.fr> wrote:
> 
> With the following source code:
> 
> int main() {
>     p = home_replace(NULL, files[i]);
>      if (p != NULL) {
>        free(files[i]);
>        files[i] = p;
>      }
> }
> 
> and the following semanticpatch:
> 
> @@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
> statement S; expression E; @@
> 
>  var = func(...);
>  ... when != var = E
> * if (var != NULL)
>    S
> 
> I get nothing.  If I remove the regular expression, then I get results
> with the above semantic patch and with the following semantic partch:
> 
> @@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
> statement S; expression E; @@
> 
>  var = func(...);
>  ... when != var = E
> * if (var != NULL)    S
> 
> Probably the issue inmy case is the kind of regular expression being used.
> Are you using pcre?
> 
> julia

[Cocci] Matching functions with attributes

[Julia Lawall]

On Thu, 22 Jan 2015, Eliseo Mart?nez wrote:

> > I get nothing
>
> Given that patch (which does not include ?home_replace? in the regex), that would be the expected result.
> Note that I didn?t include the full list of functions in my last patch (not to make it more confusing than necessary), but the actual patch I?m using contains all functions, including ?home_replace?.
>
> In any case, I?ve just realized the problem could be not in spatch, but in how I?m parsing its output through vim?s errorformat.
> So, please, forget about this by now, and sorry for the noise.
> If I do isolate a real failure in spatch, I will get back to you with a complete set of patch/source to reproduce it.

If the regular expression is a positive thing, then you would probably be
better off with

var = \(fun1\|fun2\|fun3\|fun4\)(...)
...
etc.

The Coccinelle will only parse the files that contain either fun1, fun2,
fun3, fun4, etc.

Actually, you don't even have to repeat the long list of functions for the
two rules.  You can say:

@ok@
position p;
@d@

\(fun1\|fun2\|fun3\|fun4\)(...)@p

@@
...
identifier fn;
position ok.p;
@@

var = fn(...)@p
... when != var = E
*if (var == NULL) S

etc.

It will detect that the semantic patch can only do something useful on a
file that contains either fun1, fun2, etc.

julia

>
> Thanks.
>
>
> > On 22 Jan 2015, at 12:52, Julia Lawall <julia.lawall@lip6.fr> wrote:
> >
> > With the following source code:
> >
> > int main() {
> >     p = home_replace(NULL, files[i]);
> >      if (p != NULL) {
> >        free(files[i]);
> >        files[i] = p;
> >      }
> > }
> >
> > and the following semanticpatch:
> >
> > @@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
> > statement S; expression E; @@
> >
> >  var = func(...);
> >  ... when != var = E
> > * if (var != NULL)
> >    S
> >
> > I get nothing.  If I remove the regular expression, then I get results
> > with the above semantic patch and with the following semantic partch:
> >
> > @@ identifier func =~ "^(vim_strsave|list_alloc)$"; identifier var;
> > statement S; expression E; @@
> >
> >  var = func(...);
> >  ... when != var = E
> > * if (var != NULL)    S
> >
> > Probably the issue inmy case is the kind of regular expression being used.
> > Are you using pcre?
> >
> > julia
>
>

[Cocci] Matching functions with attributes

[SF Markus Elfring]

> In any case, I?ve just realized the problem could be not in spatch,
> but in how I?m parsing its output through vim?s errorformat.

Which software development difficulties have you got at this place?

Regards,
Markus

[Cocci] Run time differences between SmPL disjunctions and regular expressions (in constraints)

[SF Markus Elfring]

> Only use regular expressions if you absolutely have to.  They are not
> interpreted when preselecting files, so they drasticaly hurt performance.

How is a file pre-selection involved here?


Would anybody like to compare the concrete run time consequences for the
specification
of a specific function name list in semantic patch scripts?
* Alternation for regular expressions in SmPL constraints
* SmPL disjunction variant

Regards,
Markus

[Cocci] Run time differences between SmPL disjunctions and regular expressions (in constraints)

[Julia Lawall]

On Thu, 22 Jan 2015, SF Markus Elfring wrote:

> > Only use regular expressions if you absolutely have to.  They are not
> > interpreted when preselecting files, so they drasticaly hurt performance.
>
> How is a file pre-selection involved here?

Perhaps it is not relevant in this case, because it is a negative
constraint.  Still, at least in the case of positive constraints, one
should be aware that a regular expression is much more expensive than just
listing n functions.

> Would anybody like to compare the concrete run time consequences for the
> specification
> of a specific function name list in semantic patch scripts?
> * Alternation for regular expressions in SmPL constraints
> * SmPL disjunction variant

Since you care so much about performance, why not do it yourself?  But I
think that it is very highly dependent on the semantic patch and the
function names involved.  For example if you mention just one function
name that is used just once in the Linux kernel, there will be only the
cost of scanning the strings in each file for that token.  If you put it
in a regular expression there will be the cost of parsing every file.  But
if the function is used in every file, eg kmalloc, the scanning cost will
go down, because the relevant files will be identified more quickly, but
the overall runtime will be high, eg the same as a regular expression for
kmalloc, because (almmost) every file will be processed anyway.

julia

[Cocci] Run time differences between SmPL disjunctions and regular expressions (in constraints)

[SF Markus Elfring]

>> Would anybody like to compare the concrete run time consequences for the
>> specification of a specific function name list in semantic patch scripts?
>> * Alternation for regular expressions in SmPL constraints
>> * SmPL disjunction variant
> Since you care so much about performance, why not do it yourself?

There are two reasons.
1. I would like to avoid the efforts for development of a representative
   test case for such a speed comparison.

2. I am using regular expressions in constraints (for my other source
code analysis)
   because of functionality that is not directly provided by the semantic
   patch language so far.
   Can it be that the regex syntax is more succinct for specific use cases?

Regards,
Markus

[Cocci] Matching functions with attributes

[Julia Lawall]

Sorry, I missed this message.

On Wed, 21 Jan 2015, Eliseo Mart?nez wrote:

> Hi,
>
> From what I?ve read, I understand attributes are not supported by coccinelle.
> But I?m still wondering it there would be a way to perform a task I?d like to do: Checking whether functions marked as returning non-null are used in any place so that return value is checked for nullness/nonnullness.
> So, this breaks into 2 subproblems:
>
> 1) Matching desired functions.
>
> I know I can?t directly match functions having certain attributes.
> But we don?t use attributes directly. We use some macros for that.
> So, all functions I?d like to pick include the macro FUNC_ATTR_NONNULL_RET in their declaration/definition.
> Then, would there be any way to match functions having the literal ?FUNC_ATTR_NONNULL_RET? in their declaration/definition?

Normally, a function header has the form

type name(T1 x1, ...)

If there are any terms outside of that pattern, parsing of the function
will simply fail.  The way around this would be to add to standard.h the
following declaration:

#define FUNC_ATTR_NONNULL_RET

Then the occurrence of FUNC_ATTR_NONNULL_RET will be ignored.  Neither
gives the inforation you want.

> 2) Applying some rules for the same set of functions.
>
> Up until now, I?ve done this by manually obtaining the list of desired functions, and then running this spatch:
>
> ```
> @@ identifier func =~ "^(transstr|list_alloc|listitem_alloc|dict_alloc|dictitem_alloc|dictitem_copy|vim_strsave_fnameescape|ga_concat_strings|enc_canonize|reverse_text|get_tv_string|get_tv_string_buf|viminfo_readstring|ga_concat_strings_sep|xmalloc|xcalloc|xrealloc|xmallocz|xmemdupz|xstrchrnul|xmemscan|xstpcpy|xstpncpy|xstrdup|xstrndup|xmemdup|msg_show_console_dialog|home_replace_save|get_register|invocation_path_tail|concat_fnames|save_absolute_path|getroom|vim_strsave|vim_strnsave|vim_strsave_escaped|vim_strsave_escaped_ext|vim_strsave_shellescape|vim_strsave_up|vim_strnsave_up|strup_save|concat_str)$"; statement S; @@
>
> (
> * if (func(...) == NULL) S;
> |
> * if (func(...) != NULL) S;
> )
>
> @@ identifier func =~ "^(transstr|list_alloc|listitem_alloc|dict_alloc|dictitem_alloc|dictitem_copy|vim_strsave_fnameescape|ga_concat_strings|enc_canonize|reverse_text|get_tv_string|get_tv_string_buf|viminfo_readstring|ga_concat_strings_sep|xmalloc|xcalloc|xrealloc|xmallocz|xmemdupz|xstrchrnul|xmemscan|xstpcpy|xstpncpy|xstrdup|xstrndup|xmemdup|msg_show_console_dialog|home_replace_save|get_register|invocation_path_tail|concat_fnames|save_absolute_path|getroom|vim_strsave|vim_strnsave|vim_strsave_escaped|vim_strsave_escaped_ext|vim_strsave_shellescape|vim_strsave_up|vim_strnsave_up|strup_save|concat_str)$"; identifier var; statement S; expression E; @@
>
>   var = func(...);
>   ... when != var = E
> (
> * if (var == NULL) S;
> |
> * if (var != NULL) S;
> )
> ```
>
> As you see, I have to replicate the list. Is there any better way to achieve the same effect?

I would not do this using a regular expression, but rather by matching and
then discarding the matches you don't like.  In ocaml this would be:

@initialize:ocaml@
@@

let fns = "list of functions"

@r@
identifier func;
statement S;
position p;
@@

if (func at p() == NULL) S

@script:ocaml@
func << r.func;
p << r.p;
@@

if List.mem func fns
then do something

You can probably figure out how to do something similar in python. In this
way the list appears only once.

julia