summaryrefslogtreecommitdiffstats
path: root/clang/lib/Analysis/AnalysisDeclContext.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Remove trailing spaceFangrui Song2018-07-301-9/+9
| | | | | | sed -Ei 's/[[:space:]]+$//' include/**/*.{def,h,td} lib/**/*.{cpp,h} llvm-svn: 338291
* [CFG] [analyzer] Add construction contexts that explain pre-C++17 copy elision.Artem Dergachev2018-06-281-1/+3
| | | | | | | | | | | | | | | | Before C++17 copy elision was optional, even if the elidable copy/move constructor had arbitrary side effects. The elidable constructor is present in the AST, but marked as elidable. In these cases CFG now contains additional information that allows its clients to figure out if a temporary object is only being constructed so that to pass it to an elidable constructor. If so, it includes a reference to the elidable constructor's construction context, so that the client could elide the elidable constructor and construct the object directly at its final destination. Differential Revision: https://reviews.llvm.org/D47616 llvm-svn: 335795
* [analyzer] [NFC] A convenient getter for getting a current stack frameGeorge Karpenkov2018-06-271-2/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D44756 llvm-svn: 335701
* [Analysis] Fix some Clang-tidy modernize and Include What You Use warnings; ↵Eugene Zelenko2018-03-211-56/+58
| | | | | | other minor fixes (NFC). llvm-svn: 328063
* [analyzer] Add scope information to CFGMaxim Ostapenko2018-03-121-3/+4
| | | | | | | | | | | This patch adds two new CFG elements CFGScopeBegin and CFGScopeEnd that indicate when a local scope begins and ends respectively. We use first VarDecl declared in a scope to uniquely identify it and add CFGScopeBegin and CFGScopeEnd elements into corresponding basic blocks. Differential Revision: https://reviews.llvm.org/D16403 llvm-svn: 327258
* [CFG] Add extra context to C++ constructor statement elements.Artem Dergachev2018-02-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new CFGStmt sub-class, CFGConstructor, which replaces the regular CFGStmt with CXXConstructExpr in it whenever the CFG has additional information to provide regarding what sort of object is being constructed. It is useful for figuring out what memory is initialized in client of the CFG such as the Static Analyzer, which do not operate by recursive AST traversal, but instead rely on the CFG to provide all the information when they need it. Otherwise, the statement that triggers the construction and defines what memory is being initialized would normally occur after the construct-expression, and the client would need to peek to the next CFG element or use statement parent map to understand the necessary facts about the construct-expression. As a proof of concept, CFGConstructors are added for new-expressions and the respective test cases are provided to demonstrate how it works. For now, the only additional data contained in the CFGConstructor element is the "trigger statement", such as new-expression, which is the parent of the constructor. It will be significantly expanded in later commits. The additional data is organized as an auxiliary structure - the "construction context", which is allocated separately from the CFGElement. Differential Revision: https://reviews.llvm.org/D42672 llvm-svn: 324668
* [analyzer] Self-debug: Dump environment frame-by-frame.Artem Dergachev2018-02-081-8/+34
| | | | | | | | | | | It makes it easier to discriminate between values of similar expressions in different stack frames. It also makes the separate backtrace section in ExplodedGraph dumps redundant. Differential Revision: https://reviews.llvm.org/D42552 llvm-svn: 324660
* [analyzer] Removing unused stored field.George Karpenkov2017-11-011-1/+1
| | | | llvm-svn: 317070
* [Analyzer] Use value storage for BodyFarmGeorge Karpenkov2017-11-011-8/+5
| | | | | | Differential Revision: https://reviews.llvm.org/D39428 llvm-svn: 317065
* [Analyzer] Give more descriptive name to BdyFrm field.George Karpenkov2017-10-251-3/+3
| | | | | | Discussion at: https://reviews.llvm.org/D39220 llvm-svn: 316617
* [Analyzer] Store BodyFarm in std::unique_ptrGeorge Karpenkov2017-10-241-7/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D39220 llvm-svn: 316536
* [Analyzer] Fix for the memory leak: fix typo in if-statement.George Karpenkov2017-10-241-1/+1
| | | | llvm-svn: 316403
* [Analyzer] Do not use static storage to for implementations created in ↵George Karpenkov2017-10-231-23/+19
| | | | | | | | BodyFarm.cpp Differential Revision: https://reviews.llvm.org/D39208 llvm-svn: 316400
* [CSA] [NFC] Move AnalysisContext.h to AnalysisDeclContext.hGeorge Karpenkov2017-09-061-1/+1
| | | | | | | | | | | | | | The implementation is in AnalysisDeclContext.cpp and the class is called AnalysisDeclContext. Making those match up has numerous benefits, including: - Easier jump from header to/from implementation. - Easily identify filename from class. Differential Revision: https://reviews.llvm.org/D37500 llvm-svn: 312671
* [CFG] Add LoopExit information to CFGPeter Szecsi2017-08-191-0/+2
| | | | | | | | | | | | | | | | This patch introduces a new CFG element CFGLoopExit that indicate when a loop ends. It does not deal with returnStmts yet (left it as a TODO). It hidden behind a new analyzer-config flag called cfg-loopexit (false by default). Test cases added. The main purpose of this patch right know is to make loop unrolling and loop widening easier and more efficient. However, this information can be useful for future improvements in the StaticAnalyzer core too. Differential Revision: https://reviews.llvm.org/D35668 llvm-svn: 311235
* CFG: Add CFGElement for automatic variables that leave the scopeMatthias Gehre2017-07-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This mimics the implementation for the implicit destructors. The generation of this scope leaving elements is hidden behind a flag to the CFGBuilder, thus it should not affect existing code. Currently, I'm missing a test (it's implicitly tested by the clang-tidy lifetime checker that I'm proposing). I though about a test using debug.DumpCFG, but then I would have to add an option to StaticAnalyzer/Core/AnalyzerOptions to enable the scope leaving CFGElement, which would only be useful to that particular test. Any other ideas how I could make a test for this feature? Reviewers: krememek, jordan_rose Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D15031 llvm-svn: 307759
* [coroutines] Fix fallthrough diagnostics for coroutinesEric Fiselier2017-05-251-0/+2
| | | | | | | | | | | | | | | | | | | | Summary: This patch fixes a number of issues with the analysis warnings emitted when a coroutine may reach the end of the function w/o returning. * Fix bug where coroutines with `return_value` are incorrectly diagnosed as missing `co_return`'s. * Rework diagnostic message to no longer say "non-void coroutine", because that implies the coroutine doesn't have a void return type, which it might. In this case a non-void coroutine is one who's promise type does not contain `return_void()` As a side-effect of this patch, coroutine bodies that contain an invalid coroutine promise objects are marked as invalid. Reviewers: GorNishanov, rsmith, aaron.ballman, majnemer Reviewed By: GorNishanov Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D33532 llvm-svn: 303831
* [Analysis] Use unique_ptr in AnalyaisDeclContextManager's ContextMap.Justin Lebar2016-10-101-9/+5
| | | | | | | | | | Reviewers: timshen Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D25426 llvm-svn: 283774
* [analyzer] Use BodyFarm-synthesized body even when actual body available.Devin Coughlin2016-03-281-6/+12
| | | | | | | | | | | | Change body autosynthesis to use the BodyFarm-synthesized body even when an actual body exists. This enables the analyzer to use the simpler, analyzer-provided body to model the behavior of the function rather than trying to understand the actual body. Further, this makes the analyzer robust against changes in headers that expose the implementations of those bodies. rdar://problem/25145950 llvm-svn: 264687
* [analyzer] Find ObjC 'self' decl even when block captures local named 'self'.Devin Coughlin2016-02-231-2/+6
| | | | | | | | | When looking up the 'self' decl in block captures, make sure to find the actual self declaration even when the block captures a local variable named 'self'. rdar://problem/24751280 llvm-svn: 261703
* [analyzer] Invalidate destination of std::copy() and std::copy_backward().Devin Coughlin2016-02-071-0/+15
| | | | | | | | | Now that the libcpp implementations of these methods has a branch that doesn't call memmove(), the analyzer needs to invalidate the destination for these methods explicitly. rdar://problem/23575656 llvm-svn: 260043
* [analyzer] Handle calling ObjC super method from inside C++ lambda.Devin Coughlin2015-11-151-0/+17
| | | | | | | | | | When calling a ObjC method on super from inside a C++ lambda, look at the captures to find "self". This mirrors how the analyzer handles calling super in an ObjC block and fixes an assertion failure. rdar://problem/23550077 llvm-svn: 253176
* Roll-back r250822.Angel Garcia Gomez2015-10-201-2/+2
| | | | | | | | | | Summary: It breaks the build for the ASTMatchers Subscribers: klimek, cfe-commits Differential Revision: http://reviews.llvm.org/D13893 llvm-svn: 250827
* Apply modernize-use-default to clang.Angel Garcia Gomez2015-10-201-2/+2
| | | | | | | | | | | | Summary: Replace empty bodies of default constructors and destructors with '= default'. Reviewers: bkramer, klimek Subscribers: klimek, alexfh, cfe-commits Differential Revision: http://reviews.llvm.org/D13890 llvm-svn: 250822
* Switch users of the 'for (StmtRange range = stmt->children(); range; ↵Benjamin Kramer2015-07-021-3/+3
| | | | | | | | | ++range)‘ pattern to range for loops. The pattern was born out of the lack of range-based for loops in C++98 and is somewhat obscure. No functionality change intended. llvm-svn: 241300
* Update APIs that return a pair of iterators to return an iterator_range instead.Benjamin Kramer2015-02-061-4/+4
| | | | | | Convert uses of those APIs into ranged for loops. NFC. llvm-svn: 228404
* Update for LLVM API change to make Small(Ptr)Set::insert return ↵David Blaikie2014-11-191-1/+1
| | | | | | pair<iterator, bool> as per the C++ standard's associative container concept. llvm-svn: 222335
* unique_ptrify the result of CFG::buildCFG/CFGBuilder::buildCFGDavid Blaikie2014-08-291-4/+3
| | | | llvm-svn: 216755
* Add support for the static analyzer to synthesize function implementations ↵Ted Kremenek2014-08-271-6/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from external model files. Currently the analyzer lazily models some functions using 'BodyFarm', which constructs a fake function implementation that the analyzer can simulate that approximates the semantics of the function when it is called. BodyFarm does this by constructing the AST for such definitions on-the-fly. One strength of BodyFarm is that all symbols and types referenced by synthesized function bodies are contextual adapted to the containing translation unit. The downside is that these ASTs are hardcoded in Clang's own source code. A more scalable model is to allow these models to be defined as source code in separate "model" files and have the analyzer use those definitions lazily when a function body is needed. Among other things, it will allow more customization of the analyzer for specific APIs and platforms. This patch provides the initial infrastructure for this feature. It extends BodyFarm to use an abstract API 'CodeInjector' that can be used to synthesize function bodies. That 'CodeInjector' is implemented using a new 'ModelInjector' in libFrontend, which lazily parses a model file and injects the ASTs into the current translation unit. Models are currently found by specifying a 'model-path' as an analyzer option; if no path is specified the CodeInjector is not used, thus defaulting to the current behavior in the analyzer. Models currently contain a single function definition, and can be found by finding the file <function name>.model. This is an initial starting point for something more rich, but it bootstraps this feature for future evolution. This patch was contributed by Gábor Horváth as part of his Google Summer of Code project. Some notes: - This introduces the notion of a "model file" into FrontendAction and the Preprocessor. This nomenclature is specific to the static analyzer, but possibly could be generalized. Essentially these are sources pulled in exogenously from the principal translation. Preprocessor gets a 'InitializeForModelFile' and 'FinalizeForModelFile' which could possibly be hoisted out of Preprocessor if Preprocessor exposed a new API to change the PragmaHandlers and some other internal pieces. This can be revisited. FrontendAction gets a 'isModelParsingAction()' predicate function used to allow a new FrontendAction to recycle the Preprocessor and ASTContext. This name could probably be made something more general (i.e., not tied to 'model files') at the expense of losing the intent of why it exists. This can be revisited. - This is a moderate sized patch; it has gone through some amount of offline code review. Most of the changes to the non-analyzer parts are fairly small, and would make little sense without the analyzer changes. - Most of the analyzer changes are plumbing, with the interesting behavior being introduced by ModelInjector.cpp and ModelConsumer.cpp. - The new functionality introduced by this change is off-by-default. It requires an analyzer config option to enable. llvm-svn: 216550
* [C++11] Use 'nullptr'. Analysis edition.Craig Topper2014-05-201-14/+14
| | | | llvm-svn: 209191
* Fix typo from r206232Richard Trieu2014-04-151-2/+2
| | | | llvm-svn: 206234
* Fix a bad interaction between -Wtautological-overlap-compare and delayedRichard Trieu2014-04-151-0/+6
| | | | | | diagnostics which caused delayed diagnostics on dead paths to be emitted. llvm-svn: 206232
* remove a bunch of unused private methodsNuno Lopes2014-03-231-5/+0
| | | | | | | | | | | | | | | | | | found with a smarter version of -Wunused-member-function that I'm playwing with. Appologies in advance if I removed someone's WIP code. ARCMigrate/TransProperties.cpp | 8 ----- AST/MicrosoftMangle.cpp | 1 Analysis/AnalysisDeclContext.cpp | 5 --- Analysis/LiveVariables.cpp | 14 ---------- Index/USRGeneration.cpp | 10 ------- Sema/Sema.cpp | 33 +++++++++++++++++++++--- Sema/SemaChecking.cpp | 3 -- Sema/SemaDecl.cpp | 20 ++------------ StaticAnalyzer/Checkers/GenericTaintChecker.cpp | 1 9 files changed, 34 insertions(+), 61 deletions(-) llvm-svn: 204561
* [C++11] Replacing BlockDecl iterators capture_begin() and capture_end() with ↵Aaron Ballman2014-03-141-6/+4
| | | | | | iterator_range captures(). Updating all of the usages of the iterators with range-based for loops. llvm-svn: 203958
* [C++11] Replacing CXXRecordDecl iterators init_begin() and init_end() with ↵Aaron Ballman2014-03-131-4/+2
| | | | | | iterator_range inits(). Updating all of the usages of the iterators with range-based for loops. llvm-svn: 203819
* Use llvm::DeleteContainerSeconds when possibleReid Kleckner2014-02-191-7/+3
| | | | llvm-svn: 201739
* [analyzer] Add a CFG node for the allocator call in a C++ 'new' expression.Jordan Rose2014-01-131-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | In an expression like "new (a, b) Foo(x, y)", two things happen: - Memory is allocated by calling a function named 'operator new'. - The memory is initialized using the constructor for 'Foo'. Currently the analyzer only models the second event, though it has special cases for both the default and placement forms of operator new. This patch is the first step towards properly modeling both events: it changes the CFG so that the above expression now generates the following elements. 1. a 2. b 3. (CFGNewAllocator) 4. x 5. y 6. Foo::Foo The analyzer currently ignores the CFGNewAllocator element, but the next step is to treat that as a call like any other. The CFGNewAllocator element is not added to the CFG for analysis-based warnings, since none of them take advantage of it yet. llvm-svn: 199123
* [analyzer] Model getters of known-@synthesized Objective-C properties.Jordan Rose2014-01-101-5/+12
| | | | | | | | | | | | | | | | | | | | | ...by synthesizing their body to be "return self->_prop;", with an extra nudge to RetainCountChecker to still treat the value as +0 if we have no other information. This doesn't handle weak properties, but that's mostly correct anyway, since they can go to nil at any time. This also doesn't apply to properties whose implementations we can't see, since they may not be backed by an ivar at all. And finally, this doesn't handle properties of C++ class type, because we can't invoke the copy constructor. (Sema has actually done this work already, but the AST it synthesizes is one the analyzer doesn't quite handle -- it has an rvalue DeclRefExpr.) Modeling setters is likely to be more difficult (since it requires handling strong/copy), but not impossible. <rdar://problem/11956898> llvm-svn: 198953
* Sort all the #include lines with LLVM's utils/sort_includes.py whichChandler Carruth2014-01-071-1/+1
| | | | | | | encodes the canonical rules for LLVM's style. I noticed this had drifted quite a bit when cleaning up LLVM, so wanted to clean up Clang as well. llvm-svn: 198686
* Only mark dump() function definitions 'used' in debug buildsAlp Toker2014-01-041-1/+1
| | | | | | | | | | | | | | | | This has the dual effect of (1) enabling more dead-stripping in release builds and (2) ensuring that debug helper functions aren't stripped away in debug builds, as they're intended to be called from the debugger. Note that the attribute is applied to definitions rather than declarations in headers going forward because it's now conditional on NDEBUG: /// \brief Mark debug helper function definitions like dump() that should not be /// stripped from debug builds. Requires corresponding macro added in LLVM r198456. llvm-svn: 198489
* [analyzer] Include analysis stack in crash traces.Jordan Rose2013-07-191-6/+10
| | | | | | | | | | | | | Sample output: 0. Program arguments: ... 1. <eof> parser at end of file 2. While analyzing stack: #0 void inlined() #1 void test() 3. crash-trace.c:6:3: Error evaluating statement llvm-svn: 186639
* [analyzer; new edges] Simplify edges in a C++11 for-range loop.Jordan Rose2013-06-061-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | Previously our edges were completely broken here; now, the final result is a very simple set of edges in most cases: one up to the "for" keyword for context, and one into the body of the loop. This matches the behavior for ObjC for-in loops. In the AST, however, CXXForRangeStmts are handled very differently from ObjCForCollectionStmts. Since they are specified in terms of equivalent statements in the C++ standard, we actually have implicit AST nodes for all of the semantic statements. This makes evaluation very easy, but diagnostic locations a bit trickier. Fortunately, the problem can be generally defined away by marking all of the implicit statements as part of the top-level for-range statement. One of the implicit statements in a for-range statement is the declaration of implicit iterators __begin and __end. The CFG synthesizes two separate DeclStmts to match each of these decls, but until now these synthetic DeclStmts weren't in the function's ParentMap. Now, the CFG keeps track of its synthetic statements, and the AnalysisDeclContext will make sure to add them to the ParentMap. <rdar://problem/14038483> llvm-svn: 183449
* Revert "[analyzer; alternate edges] improve support for edges with ↵Jordan Rose2013-05-181-22/+8
| | | | | | | | | | | | | PseudoObjectExprs." Ted and I spent a long time discussing this today and found out that neither the existing code nor the new code was doing what either of us thought it was, which is never good. The good news is we found a much simpler way to fix the motivating test case (an ObjCSubscriptExpr). This reverts r182083, but pieces of it will come back in subsequent commits. llvm-svn: 182185
* [analyzer; alternate edges] improve support for edges with PseudoObjectExprs.Ted Kremenek2013-05-171-8/+22
| | | | | | | | | | | | | | | | | | This optimizes some spurious edges resulting from PseudoObjectExprs. This required far more changes than I anticipated. The current ParentMap does not record any hierarchy information between a PseudoObjectExpr and its *semantic* expressions that may be wrapped in OpaqueValueExprs, which are the expressions actually laid out in the CFG. This means the arrow pruning logic could not map from an expression to its containing PseudoObjectExprs. To solve this, this patch adds a variant of ParentMap that returns the "semantic" parentage of expressions (essentially as they are viewed by the CFG). This alternate ParentMap is then used by the arrow reducing logic to identify edges into pseudo object expressions, and then eliminate them. llvm-svn: 182083
* [analyzer] Add debug helper LocationContext::dumpStack().Jordan Rose2013-03-301-0/+26
| | | | | | | | | | | Sample output: #0 void construct(pointer __p, llvm::ImutAVLTree<llvm::ImutContainerInfo<clang::ento::BugType *> > *const &__val) #1 void push_back(const value_type &__x) #2 void destroy() #3 void release() #4 void ~ImmutableSet() llvm-svn: 178400
* Add configuration plumbing to enable static initializer branching in the CFG ↵Ted Kremenek2013-03-291-1/+3
| | | | | | | | | for the analyzer. This setting still isn't enabled yet in the analyzer. This is just prep work. llvm-svn: 178317
* clang/Analysis: Fix r174245, a valgrind error in ↵NAKAMURA Takumi2013-02-041-0/+1
| | | | | | AnalysisDeclContext::getBody(bool &IsAutosynthesized), to initialize IsAutosynthesized explicitly. llvm-svn: 174303
* [analyzer] Always inline functions with bodies generated by BodyFarm.Anna Zaks2013-02-021-2/+15
| | | | | | | | Inlining these functions is essential for correctness. We often have cases where we do not inline calls. For example, the shallow mode and when reanalyzing previously inlined ObjC methods as top level. llvm-svn: 174245
* Use the BlockDecl captures list to infer the direct captures for a ↵Ted Kremenek2012-12-061-4/+7
| | | | | | | | | BlockDataRegion. Fixes <rdar://problem/12415065>. We still need to do a recursive walk to determine all static/global variables referenced by a block, which is needed for region invalidation. llvm-svn: 169481
* Sort all of Clang's files under 'lib', and fix up the broken headersChandler Carruth2012-12-041-5/+4
| | | | | | | | | | | | | uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
OpenPOWER on IntegriCloud