| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(1) libAnalysis is a generic analysis library that can be used by
Sema. It defines the CFG, basic dataflow analysis primitives, and
inexpensive flow-sensitive analyses (e.g. LiveVariables).
(2) libChecker contains the guts of the static analyzer, incuding the
path-sensitive analysis engine and domain-specific checks.
Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.
This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker. More changes pending. :)
This change also exposed a layering violation between AnalysisContext
and MemRegion. BlockInvocationContext shouldn't explicitly know about
BlockDataRegions. For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet). We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.
llvm-svn: 94406
|
|
|
|
| |
llvm-svn: 93181
|
|
|
|
| |
llvm-svn: 93175
|
|
|
|
|
|
| |
expression as an lvalue when the return type is a C++ reference.
llvm-svn: 91926
|
|
|
|
| |
llvm-svn: 91751
|
|
|
|
|
|
| |
'FD->getIdentifier()' will not always return a non-null IdentifierInfo*.
llvm-svn: 91512
|
|
|
|
|
|
|
|
|
| |
Remove isPod() from DenseMapInfo, splitting it out to its own
isPodLike type trait. This is a generally useful type trait for
more than just DenseMap, and we really care about whether something
acts like a pod, not whether it really is a pod.
llvm-svn: 91422
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters.
- VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference)
- Add transfer function support to GRExprEngine for BlockDeclRefExprs.
This change also supports analyzing blocks as an analysis entry point
(top-of-the-stack), which required pushing more context-sensitivity
around in the MemRegion hierarchy via the use of LocationContext
objects. Functionally almost everything is the same, except we track
LocationContexts in a few more areas and StackSpaceRegions now refer
to a StackFrameContext object. In the future we will need to modify
MemRegionManager to allow multiple StackSpaceRegions in flight at once
(for the analysis of multiple stack frames).
llvm-svn: 90809
|
|
|
|
|
|
| |
invoking a block (without specific reasoning of what the block does) can invalidate any value to it by reference when the block was created.
llvm-svn: 90431
|
|
|
|
|
|
| |
multiple regions as once. After adopting this in the CFRefCount::EvalCall(), we see a reduction in analysis time of 1.5% when analyzing all of SQLite3.
llvm-svn: 90405
|
|
|
|
|
|
|
|
|
|
|
| |
we don't need to use the DoneEvaluation hack when check for
ObjCMessageExpr.
PreVisitObjCMessageExpr() only checks for undefined receiver or arguments.
Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface.
llvm-svn: 90296
|
|
|
|
| |
llvm-svn: 90086
|
|
|
|
| |
llvm-svn: 90028
|
|
|
|
|
|
|
|
| |
the set of variables "captured" by a block. Until the analysis gets
more sophisticated, for now we stop the retain count tracking of any
objects (transitively) referenced by these variables.
llvm-svn: 89929
|
|
|
|
|
|
|
|
|
|
|
| |
'BlockDataRegion' to distinguish between the code associated with a
block (which is represented by 'BlockTextRegion') and an instance of a
block, which includes both code and data. 'BlockDataRegion' has an
associated LocationContext, which can be used to eventually model the
lifetime of a block object once LocationContexts can represent scopes
(and iterations around a loop, etc.).
llvm-svn: 89900
|
|
|
|
|
|
| |
extend the functionality of the retain/release checker using the new Checker interface. Pieces of CFRefCount will gradually be migrated to this new class over time.
llvm-svn: 89889
|
|
|
|
| |
llvm-svn: 89888
|
|
|
|
|
|
| |
anytime we pass a tracked object to a block call we stop tracking it.
llvm-svn: 89831
|
|
|
|
|
|
| |
CallAndMessageChecker.
llvm-svn: 89745
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
sugared types. The basic problem is that our qualifier accessors
(getQualifiers, getCVRQualifiers, isConstQualified, etc.) only look at
the current QualType and not at any qualifiers that come from sugared
types, meaning that we won't see these qualifiers through, e.g.,
typedefs:
typedef const int CInt;
typedef CInt Self;
Self.isConstQualified() currently returns false!
Various bugs (e.g., PR5383) have cropped up all over the front end due
to such problems. I'm addressing this problem by splitting each
qualifier accessor into two versions:
- the "local" version only returns qualifiers on this particular
QualType instance
- the "normal" version that will eventually combine qualifiers from this
QualType instance with the qualifiers on the canonical type to
produce the full set of qualifiers.
This commit adds the local versions and switches a few callers from
the "normal" version (e.g., isConstQualified) over to the "local"
version (e.g., isLocalConstQualified) when that is the right thing to
do, e.g., because we're printing or serializing the qualifiers. Also,
switch a bunch of
Context.getCanonicalType(T1).getUnqualifiedType() == Context.getCanonicalType(T2).getQualifiedType()
expressions over to
Context.hasSameUnqualifiedType(T1, T2)
llvm-svn: 88969
|
|
|
|
| |
llvm-svn: 87065
|
|
|
|
|
|
| |
instance method summaries. No real functionality change, but it paves the way for new enhancements.
llvm-svn: 87062
|
|
|
|
|
|
| |
getBaseRegion will be used in another method.
llvm-svn: 86649
|
|
|
|
|
|
| |
a BugReporter&. This paves the way for pulling some of the retain/release checker into a "Checker" class.
llvm-svn: 85971
|
|
|
|
|
|
| |
from CFRefCount.cpp to ASTContext.h. These functions are likely to be generally useful.
llvm-svn: 85886
|
|
|
|
| |
llvm-svn: 85867
|
|
|
|
|
| |
Fixes: <rdar://problem/7358899>
llvm-svn: 85864
|
|
|
|
|
|
|
| |
before '_' when determining Cocoa fundamental rule.
Fixes: <rdar://problem/7265711>
llvm-svn: 84569
|
|
|
|
|
|
| |
are updated.
llvm-svn: 84447
|
|
|
|
| |
llvm-svn: 84436
|
|
|
|
| |
llvm-svn: 84342
|
|
|
|
| |
llvm-svn: 84341
|
|
|
|
|
|
|
|
| |
touched by StoreManager::InvalidateRegion().
This fixes <rdar://problem/7257223> and <rdar://problem/7283470>.
llvm-svn: 84223
|
|
|
|
|
|
| |
This fixes <rdar://problem/7306898>
llvm-svn: 84213
|
|
|
|
|
|
| |
summaries. No functionality change.
llvm-svn: 84210
|
|
|
|
| |
llvm-svn: 84157
|
|
|
|
|
|
|
|
|
|
| |
'CVPixelBufferCreateWithPlanarBytes()' and
'CVPixelBufferCreateWithBytes' (Core Video API) can indirectly release
a pixel buffer object via a callback.
This fixes <rdar://problem/7283567>.
llvm-svn: 84064
|
|
|
|
|
|
|
|
| |
the data argument) should not be tracked further until we support full IPA.
(fixes <rdar://problem/7299394>)
llvm-svn: 84047
|
|
|
|
| |
llvm-svn: 83204
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
<rdar://problem/6914474> checker doesn't realize that variable might
have been assigned if a pointer to that variable was passed to another
function via a structure
The problem here was the RegionStoreManager::InvalidateRegion didn't
invalidate the bindings of invalidated regions. This required a
rewrite of this method using a worklist.
As part of this fix, changed ValueManager::getConjuredSymbolVal() to
require a 'void*' SymbolTag argument. This tag is used to
differentiate two different symbols created at the same location.
llvm-svn: 82920
|
|
|
|
|
|
| |
(via integer) to function call not invalidated
llvm-svn: 82523
|
|
|
|
|
|
|
|
|
|
|
| |
Several of the existing methods were identical to their respective
specializations, and so have been removed entirely. Several more 'leaf'
optimizations were introduced.
The getAsFoo() methods which imposed extra conditions, like
getAsObjCInterfacePointerType(), have been left in place.
llvm-svn: 82501
|
|
|
|
|
|
| |
to a noreturn or panic function
llvm-svn: 81803
|
|
|
|
|
|
| |
local node information.
llvm-svn: 81433
|
|
|
|
| |
llvm-svn: 81346
|
|
|
|
|
|
|
| |
objects that are not automatically garbage collected. This fixes
<rdar://problem/7174400>.
llvm-svn: 80387
|
|
|
|
| |
llvm-svn: 80294
|
|
|
|
|
|
| |
greatly simplifying the logic of the analyzer in many places. We now only distinguish between block-level expressions and subexpressions in Environment::RemoveDeadBindings and GRState pretty-printing.
llvm-svn: 80194
|
|
|
|
|
|
|
| |
Now AnalysisManager is the only place we can get CodeDecl.
This leads to an API change: GRState::bindExpr() now takes the CFG argument.
llvm-svn: 79980
|
|
|
|
| |
llvm-svn: 79973
|