summaryrefslogtreecommitdiffstats
path: root/clang/lib/Analysis/BasicStore.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so Zhongxing Xu2009-02-051-2/+4
| | | | | | | | | | | | | | do the symblic regions associated with them and we need them to be typed. Current SymbolicRegion::getRValueType() method is very restricting. It may be modified when we are more clear about what could be the types of symblic regions. BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a subclass of SubRegion. llvm-svn: 63844
* Fix bug in BasicStore::getLValueElement where if the base of an array ↵Ted Kremenek2009-01-271-2/+12
| | | | | | | | subscript expression was an ElementRegion we stacked another ElementRegion on top of that. This fixes PR 3422. llvm-svn: 63110
* Static analyzer: Remove a bunch of outdated SymbolData objects andTed Kremenek2009-01-221-3/+4
| | | | | | | | | | | | | | | | | | | | their associated APIs. We no longer need separate SymbolData objects for fields, variables, etc. Instead, we now associated symbols with the "rvalue" of a MemRegion (i.e., the value stored at that region). Now we only have two kinds of SymbolData objects: SymbolRegionRValue and SymbolConjured. This cleanup also makes the distinction between a SymbolicRegion and a symbolic value that is a location much clearer. A SymbolicRegion represents a chunk of symbolic memory, while a symbolic location is just a "pointer" with different possible values. Without any specific knowledge, a symbolic location resolves (i.e., via a dereference) to a SymbolicRegion. In the future, when we do better alias reasoning, a symbolic location can become an alias for another location, thus merging the constraints on the referred SymbolicRegion with the other region. llvm-svn: 62769
* Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek2009-01-211-13/+13
| | | | | | called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. llvm-svn: 62722
* Update some doxygen comments to be more rich. Remove ↵Ted Kremenek2009-01-071-16/+16
| | | | | | StoreManager::GetRegionSVal. llvm-svn: 61894
* Refactor MemRegionManager instance variable into parent class. No ↵Ted Kremenek2009-01-071-4/+2
| | | | | | functionality change. llvm-svn: 61888
* Use utility method.Zhongxing Xu2008-12-211-1/+1
| | | | llvm-svn: 61304
* Use utility methods. No functional change.Zhongxing Xu2008-12-211-10/+10
| | | | llvm-svn: 61300
* Remove unused function.Zhongxing Xu2008-12-211-6/+0
| | | | llvm-svn: 61299
* Lazy bingding for region-store manager.Zhongxing Xu2008-12-201-15/+41
| | | | | | | | | | | | | * Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. llvm-svn: 61274
* MemRegion:Ted Kremenek2008-12-131-5/+24
| | | | | | | | | | | | | | | | | | | | | | - Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. llvm-svn: 60995
* A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek2008-12-131-6/+17
| | | | | | | | | | | | | | | | | | GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. llvm-svn: 60990
* Fix to BasicStoreManager::getElementLValue: If the base region is a symbol, ↵Ted Kremenek2008-12-091-2/+13
| | | | | | layer an AnonTypedRegion on top of it. llvm-svn: 60808
* Have BasicStoreManager::getLValueElement() have logic similar to ↵Ted Kremenek2008-12-091-2/+37
| | | | | | BasicStoreManager::getLValueField() (i.e., don't just return the 'base' as the SVal) llvm-svn: 60795
* StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek2008-12-051-10/+13
| | | | | | GRState* argument instead of a Store. This allows them to use the GDM for storing other data. llvm-svn: 60570
* Update comment.Ted Kremenek2008-12-041-0/+3
| | | | llvm-svn: 60520
* Use std::make_pair instead of std::pair's ctor.Zhongxing Xu2008-11-281-1/+1
| | | | llvm-svn: 60205
* Migrate some stuff from NamedDecl::getName() to Chris Lattner2008-11-241-1/+1
| | | | | | NamedDecl::getNameAsString() to make it more explicit. llvm-svn: 59937
* Enhance modularization: return a <state,loc> pair to let GRExprEngine modify theZhongxing Xu2008-11-161-3/+3
| | | | | | environment. llvm-svn: 59407
* Enhances SCA to process untyped region to typed region conversion.Zhongxing Xu2008-11-161-0/+6
| | | | | | | | | | | | - RegionView and RegionViewMap is introduced to assist back-mapping from super region to subregions. - GDM is used to carry RegionView information. - AnonTypedRegion is added to represent a typed region introduced by pointer casting. Later AnonTypedRegion can be used in other similar cases, e.g., malloc()'ed region. - The specific conversion is delegated to store manager. llvm-svn: 59382
* Use the allocator of ExplodedGraph. The whole static analysis module uses it.Zhongxing Xu2008-11-151-1/+4
| | | | llvm-svn: 59359
* StoreManager::BindDecl now takes an SVal* for the initialization value ↵Ted Kremenek2008-11-121-19/+8
| | | | | | instead of an Expr* (which can be null). Lazy symbolication of conjured symbols is now the sole responsibility of GRExprEngine. llvm-svn: 59151
* Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is Zhongxing Xu2008-11-071-3/+10
| | | | | | | | | available, things get much simplified. One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue context. llvm-svn: 58837
* Rename: AddDecl => BindDeclZhongxing Xu2008-10-291-6/+4
| | | | | | | | BindDecl better describes what the function does: - Bind the VarDecl to its memory region - Bind the memory region to some initial value. llvm-svn: 58359
* Added preliminary support for CompoundLiterals in the static analyzer:Ted Kremenek2008-10-271-0/+5
| | | | | | | | | | | | | | | | | | | | - GRExprEngine::VisitCompoundLiteral... (1) visits the initializer list (generating ExplodedNodes) (2) creates a CompoundMemRegion for the literal (3) creates a new state with the bound literal values using GRStateManager::BindCompoundLiteral - GRStateManager::BindCompoundLiteral simply calls StoreManager::BindCompoundLiteral to get a new store and returns a persistent GRState with that store. - BasicStore::BindCompoundLiteral simply returns the same store, as it doesn't handle field sensitivity - RegionStore::BindCompoundLiteral currently fires an assert (pending discussion of how to best implement mappings for CompoundLiteralRegion). llvm-svn: 58277
* Remove loc::StringLiteralVal. Now we allocate regions for string literals in ↵Zhongxing Xu2008-10-261-5/+0
| | | | | | the Store. llvm-svn: 58182
* Add code for get the lvalue for string literals. Now we return a StringRegionZhongxing Xu2008-10-251-0/+6
| | | | | | | for StringLiteral lvalue evaluation, instead of directly returning a loc::StringLiteralVal by the Environment. llvm-svn: 58138
* Added method "getSelfRegion" to Store. This method returns the region ↵Ted Kremenek2008-10-241-21/+41
| | | | | | associated with the "this" or "self" object (C++ and Objective-C respectively). llvm-svn: 58107
* Let StoreManager do different cast on arrays. BasicStore will just keep it ↵Zhongxing Xu2008-10-231-0/+2
| | | | | | intact. llvm-svn: 58028
* Adjust parameter order to more natural one.Zhongxing Xu2008-10-221-3/+3
| | | | llvm-svn: 57964
* Preliminary support for function overloadingDouglas Gregor2008-10-211-2/+2
| | | | llvm-svn: 57909
* Localize the special processing of array variable inside Zhongxing Xu2008-10-211-0/+1
| | | | | | | | | | | GRExprEngine::VisitCast() so that other parts of the analyzer can be ignorant. When we cast "array of type T" to "pointer to T", we get the loc::MemRegionVal corresponding to the array variable. This is sufficient for BasicStore, but not for RegionStore. RegionStore should get the element region for the first array element in the cast. So next comes to the revamping of transfer functions for different store model. llvm-svn: 57897
* Modify Store interface: GetSVal/SetSVal => Retrieve/Bind.Zhongxing Xu2008-10-211-11/+11
| | | | llvm-svn: 57896
* Hack: have BasicStore::getLValueElement return the "Base" lvalue. This ↵Ted Kremenek2008-10-171-15/+28
| | | | | | | | restores null dereference checking with array accesses. BasicStore::RemoveDeadBindings: handle regions besides VarRegions (we now have FieldRegions). llvm-svn: 57741
* - constify some uses of MemRegion* (MemRegion should be immutable).Ted Kremenek2008-10-171-5/+39
| | | | | | | | | - Added new region "SymbolicRegion", which maps symbol values to the region domain. - Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion) - Added some utility methods to GRState for fetch svals from the store. - Fixed regression in CheckNSError (we weren't getting the value bound to the parameter) llvm-svn: 57717
* This patch did the following renaming. There should be no functional changes.Zhongxing Xu2008-10-171-61/+61
| | | | | | | | | | RVal => SVal LVal => Loc NonLVal => NonLoc lval => loc nonlval => nonloc llvm-svn: 57671
* Array and struct variables do have lvalue. For example,Zhongxing Xu2008-10-171-2/+0
| | | | | | | | | | | | | | | | | | struct s {}; void f() { int a[10]; int (*p)[10]; p = &a; (*p)[3] =1; struct s d; struct s *q; q = &d; } We return the corresponding MemRegionVal for them. llvm-svn: 57664
* Remove lval::FieldOffset, lval::ArrayOffset. These will be replaced with ↵Ted Kremenek2008-10-171-41/+25
| | | | | | | | | | | regions. Remove GRExprEngine::getLVal and RValues::MakeVal. Enhance StoreManager "GetLValue" methods to dispatch for specific kinds of lvalue queries, as opposed to interogating the expression tree (GRExprEngine already does this). Added FIXMEs. In particular, we no longer "assume" that a base pointer in a field/array access is null (this logic was removed). Perhaps we should do this when fetching the lvalue for fields and array elements? llvm-svn: 57657
* Add transfer function support for ObjCIvarRefExpr.Ted Kremenek2008-10-171-0/+6
| | | | llvm-svn: 57654
* This is the first step to build a better evaluation model for GRExprEngine. AZhongxing Xu2008-10-161-0/+32
| | | | | | | | new VisitLValue method is added to replace the old VisitLVal. The semantics model becomes more explicit to separate rvalue evaluation from lvalue evaluation. llvm-svn: 57627
* Migrate MemRegionManager from StateManager to StoreManager.Zhongxing Xu2008-10-071-10/+18
| | | | llvm-svn: 57225
* Remove redundant parameter and rename StMgr to StateMgr.Zhongxing Xu2008-10-051-14/+14
| | | | llvm-svn: 57107
* This is a big patch, but the functionality change is small and the rest of ↵Ted Kremenek2008-10-041-140/+62
| | | | | | | | | | | | | | the patch consists of deltas due to API changes. This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h. This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses. This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on. The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls. In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal. Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables. There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized. The memory region abstraction also allows type-information to literally be affixed to a memory region. This will allow the some now redundant logic to be removed from the retain/release checker. llvm-svn: 57042
* Store: (static analyzer)Ted Kremenek2008-09-031-28/+88
| | | | | | | | | | | | | | | | | | | | | - Change definition of store::Region and store::Binding (once again) to make them real classes that just wrap pointers. This makes them more strictly typed, and allows specific implementations of Regions/Bindings to just subclass them. - minor renamings to RegionExtent and its subclasses - added a bunch of doxygen comments StoreManager: (static analyzer) - added 'iterBindings', an iteration method for iterating over the bindings of a store. It that takes a callback object (acting like a poor man's closure). - added 'getRVal' version for store::Binding. Will potentially phase the other versions of GetRVal in StoreManager out. - reimplemented 'getBindings' to be non-virtual and to use 'iterBindings' BasicStoreManager: (static analyzer) - implemented 'iterBindings' for BasicStoreManager llvm-svn: 55688
* Added "getBindings" and "BindingAsString" to GRStateManager and StoreManager.Ted Kremenek2008-08-291-0/+34
| | | | | | | Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of making assumptions about the Store (removed dependence on GRState::vb_iterator). llvm-svn: 55522
* Remove BasicStore.h (migrated function prototype for CreateBasicStore() to ↵Ted Kremenek2008-08-281-1/+0
| | | | | | Store.h) llvm-svn: 55519
* Make store "Regions" and "Bindings" more abstract instead of concrete variants.Ted Kremenek2008-08-281-12/+22
| | | | | | | | Their precise semantics will be implemented by a specific StoreManager. Use function pointer to create the StoreManager in GRStateManager. This matches how we create ConstraintsManager. llvm-svn: 55514
* Added 'extents' for Regions.Ted Kremenek2008-08-251-26/+17
| | | | | | | Added 'getExtent()' to StoreManager. Implemented 'getExtent()' for BasicStoreManager. llvm-svn: 55321
* Simplify interface to Store::AddDeclTed Kremenek2008-08-231-5/+9
| | | | llvm-svn: 55213
* Move the handling of DeclStmt from GRExprEngine to BasicStoreManager.Zhongxing Xu2008-08-211-1/+68
| | | | llvm-svn: 55144
OpenPOWER on IntegriCloud