summaryrefslogtreecommitdiffstats
path: root/clang/lib/Analysis/MemRegion.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek2010-01-251-800/+0
| | | | | | | | | | | | | | | | | | | | | | | | | (1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. llvm-svn: 94406
* Roll out ASTContext::getTypeSizeInChars(), replacing instances ofKen Dyck2010-01-111-3/+4
| | | | | | | | | | "ASTContext::getTypeSize() / 8". Replace [u]int64_t variables with CharUnits ones as appropriate. Also rename RawType, fromRaw(), and getRaw() in CharUnits to QuantityType, fromQuantity(), and getQuantity() for clarity. llvm-svn: 93153
* When binding an rvalue to a reference, create a temporary object. Use Zhongxing Xu2010-01-091-5/+8
| | | | | | | | CXXObjectRegion to represent it. In Environment, lookup a literal expression before make up a value for it. llvm-svn: 93047
* Make static analysis support for C++ 'this' expression context-sensitive. ↵Ted Kremenek2010-01-051-14/+31
| | | | | | Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it. llvm-svn: 92675
* Completely remove ObjCObjectRegion (tests pass this time).Ted Kremenek2009-12-161-6/+0
| | | | llvm-svn: 91572
* Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu2009-12-161-0/+16
| | | | | | | | attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. llvm-svn: 91535
* Fix: <rdar://problem/7468209> SymbolManager::isLive() should not crash on ↵Ted Kremenek2009-12-141-0/+9
| | | | | | captured block variables that are passed by reference llvm-svn: 91348
* Enhance understanding of VarRegions referenced by a block whose declarations ↵Ted Kremenek2009-12-111-9/+22
| | | | | | are outside the current stack frame. Fixes <rdar://problem/7462324>. llvm-svn: 91107
* Add analysis support for blocks. This includes a few key changes:Ted Kremenek2009-12-071-138/+139
| | | | | | | | | | | | | | | | | - Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters. - VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference) - Add transfer function support to GRExprEngine for BlockDeclRefExprs. This change also supports analyzing blocks as an analysis entry point (top-of-the-stack), which required pushing more context-sensitivity around in the MemRegion hierarchy via the use of LocationContext objects. Functionally almost everything is the same, except we track LocationContexts in a few more areas and StackSpaceRegions now refer to a StackFrameContext object. In the future we will need to modify MemRegionManager to allow multiple StackSpaceRegions in flight at once (for the analysis of multiple stack frames). llvm-svn: 90809
* constify MemRegion* returned by MemRegionManager::getXXXRegion() methods.Ted Kremenek2009-12-041-24/+26
| | | | llvm-svn: 90503
* More template-logic for MemRegion construction out of MemRegion.h and into ↵Ted Kremenek2009-12-041-0/+155
| | | | | | MemRegion.cpp. llvm-svn: 90499
* Make BlockDataRegion::referenced_vars_iterator an actual class that enforces ↵Ted Kremenek2009-12-031-2/+4
| | | | | | that all MemRegions iterated over are VarRegions. llvm-svn: 90430
* Provide the correct vector size for referenced variables.Ted Kremenek2009-12-011-1/+1
| | | | llvm-svn: 90267
* Add iterators to BlockDataRegion that allow clients to iterate over the ↵Ted Kremenek2009-11-261-1/+61
| | | | | | VarRegions for "captured" variables for a block. llvm-svn: 89927
* Refine MemRegions for blocks. Add a new region calledTed Kremenek2009-11-251-1/+31
| | | | | | | | | | | 'BlockDataRegion' to distinguish between the code associated with a block (which is represented by 'BlockTextRegion') and an instance of a block, which includes both code and data. 'BlockDataRegion' has an associated LocationContext, which can be used to eventually model the lifetime of a block object once LocationContexts can represent scopes (and iterations around a loop, etc.). llvm-svn: 89900
* Split CodeTextRegion into FunctionTextRegion and BlockTextRegion. This a ↵Ted Kremenek2009-11-251-9/+31
| | | | | | precursor to having basic static analysis support for blocks. llvm-svn: 89828
* Refine PointerSubChecker: compare the base region instead of the original Zhongxing Xu2009-11-101-0/+18
| | | | | | region, so that arithmetic within a memory chunk is allowed. llvm-svn: 86652
* Rename: StripCasts describes what it does better. Zhongxing Xu2009-11-101-1/+1
| | | | | | getBaseRegion will be used in another method. llvm-svn: 86649
* Remove tabs, and whitespace cleanups.Mike Stump2009-09-091-19/+19
| | | | llvm-svn: 81346
* Use SymbolicRegion instead of CodeTextRegion for symbolic functionTed Kremenek2009-08-281-19/+8
| | | | | | | | pointers. Most logic cares first about whether or not a region is symbolic, and second if represents code. This should fix a series of silent corner case bugs (as well as simplify a bunch of code). llvm-svn: 80335
* Remove 'SelfRegion' field from both BasicStoreManager and RegionStoreManager.Ted Kremenek2009-08-211-2/+9
| | | | | | | | | | | | | | | | | | SelfRegion represented the object bound to 'self' (when analyzing Objective-C methods) upon entry to a method. Having this region stored on the side ignores the current stack frame that we might be analyzing (among other things), and is a problem for interprocedural analysis. For RegionStoreManager, the value for SelfRegion is just lazily created. For BasicStoreManager, the value for SelfRegion is bound eagerly to 'self', but no explicit tracking of SelfRegion on the side is made. As part of this change, remove the restriction in BasicStoreManager that we only track ivars for 'self'. This shouldn't actually change anything in terms of precision, and simplifies the logic. llvm-svn: 79694
* Add LocationContext* field to VarRegion. This is needed for interprocedural ↵Ted Kremenek2009-08-211-2/+7
| | | | | | analysis. llvm-svn: 79680
* This is a fairly large patch, which resulted from a cascade of changesTed Kremenek2009-08-011-4/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | made to RegionStore (and related classes) in order to handle some analyzer failures involving casts and manipulation of symbolic memory. The root of the change is in StoreManager::CastRegion(). Instead of using ad hoc heuristics to decide when to layer an ElementRegion on a casted MemRegion, we now always layer an ElementRegion when the cast type is different than the original type of the region. This carries the current cast information associated with a region around without resorting to the error prone recording of "casted types" in GRState. Along with this new policy of layering ElementRegions, I added a new algorithm to strip away existing ElementRegions when they simply represented casts of a base memory object. This algorithm computes the raw "byte offset" that an ElementRegion represents from the base region, and allows the new ElementRegion to be based off that offset. The added benefit is that this naturally handles a series of casts of a MemRegion without building up a set of redundant ElementRegions (thus canonicalizing the region view). Other related changes that cascaded from this one (as tests were failing in RegionStore): - Revamped RegionStoreManager::InvalidateRegion() to completely remove all bindings and default values from a region and all subregions. Now invalidated fields are not bound directly to new symbolic values; instead the base region has a "default" symbol value from which "derived symbols" can be created. The main advantage of this approach is that it allows us to invalidate a region hierarchy and then lazily instantiate new values no matter how deep the hierarchy went (i.e., regardless of the number of field accesses, e.g. x->f->y->z->...). The previous approach did not do this. - Slightly reworked RegionStoreManager::RemoveDeadBindings() to also incorporate live symbols and live regions that do not have direct bindings but also have "default values" used for lazy instantiation. The changes to 'InvalidateRegion' revealed that these were necessary in order to achieve lazy instantiation of values in the region store with those bindings being removed too early. - The changes to InvalidateRegion() and RemoveDeadBindings() revealed a serious bug in 'getSubRegionMap()' where not all region -> subregion relationships involved in actually bindings (explicit and implicit) were being recorded. This has been fixed by using a worklist algorithm to iteratively fill in the region map. - Added special support to RegionStoreManager::Bind()/Retrieve() to handle OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the layering of ElementRegions. - Fixed a bug in SymbolReaper::isLive() where derived symbols were not being marked live if the symbol they were derived from was also live. This fix was critical for getting lazy instantiation in RegionStore to work. - Tidied up the implementation of ValueManager::getXXXSymbolVal() methods to use SymbolManager::canSymbolicate() to decide whether or not a symbol should be symbolicated. - 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been moved to 'test/Analysis/misc-ps.m'. - Tweaked some pretty-printing of MemRegions, and implemented 'ElementRegion::getRawOffset()' for use with the CastRegion changes. llvm-svn: 77782
* Remove 'StoreManager::OldCastRegion()', TypedViewRegion (which onlyTed Kremenek2009-07-291-27/+0
| | | | | | | OldCastRegion used), and the associated command line option '-analyzer-store=old-basic-cast'. llvm-svn: 77509
* Add 'MemRegion::getBaseRegion()', a utility method to strip ElementRegions withTed Kremenek2009-07-291-0/+20
| | | | | | index 0. This will be used for refinements to InvalidateRegion and CastRegion. llvm-svn: 77481
* Implement FIXME in pretty-printing for StringRegions.Ted Kremenek2009-07-191-3/+2
| | | | llvm-svn: 76381
* Improve debug pretty-printing for ObjCIVarRegions.Ted Kremenek2009-07-191-0/+4
| | | | llvm-svn: 76380
* Move RegionStoreManager over to using newTed Kremenek2009-07-161-1/+2
| | | | | | | | ValueManager::makeArrayIndex()/convertArrayIndex() methods. This handles yet another crash case when reasoning about array indices of different bitwidth and signedness. llvm-svn: 75884
* Tidy pretty-printing for SVals, using 'dump()' instead of 'printStdErr()', ↵Ted Kremenek2009-07-131-1/+1
| | | | | | and implementing operator<< support for llvm::raw_ostream. llvm-svn: 75560
* When pretty-printing symbolic regions, use '{' ... '}' to indicate the ↵Ted Kremenek2009-07-131-1/+1
| | | | | | symbol used for the region (makes it easier to read for nested regions). llvm-svn: 75550
* Change pretty-printing API for SymExprs and MemRegions to use a naming ↵Ted Kremenek2009-07-131-20/+17
| | | | | | convention and style similar to other elements in Clang. llvm-svn: 75548
* Rename potentially ambiguous member template 'getRegion' to 'getSubRegion' ↵Ted Kremenek2009-07-101-4/+4
| | | | | | to hopefully resolve template lookup ambiguities on some compilers. llvm-svn: 75253
* Enhance RegionStore to lazily symbolicate fields and array elements forTed Kremenek2009-07-021-0/+7
| | | | | | structures passed-by-value as function arguments. llvm-svn: 74729
* StoreManagers: Use 'hasGlobalsStorage()' and 'hasParametersStorage()' instead ofTed Kremenek2009-07-021-1/+17
| | | | | | | directly consulting if a VarDecl is an implicit or actual parameter, a global, etc. llvm-svn: 74716
* Add a separate MemSpaceRegion for function/method arguments passed on the stack.Ted Kremenek2009-07-021-3/+11
| | | | | | | This will simplify the logic of StoreManagers that want to specially reason about the values of parameters. llvm-svn: 74715
* Remove commented methods. Add MemRegion::printStdErr().Ted Kremenek2009-07-021-0/+4
| | | | llvm-svn: 74709
* Key decisions about 'bool' vs '_Bool' to be based on a new flag in langoptions.Chris Lattner2009-06-301-1/+2
| | | | | | | | | | | | This is simple enough, but then I thought it would be nice to make PrintingPolicy get a LangOptions so that various things can key off "bool" and "C++" independently. This spiraled out of control. There are many fixme's, but I think things are slightly better than they were before. One thing that can be improved: CFG should probably have an ASTContext pointer in it, which would simplify its clients. llvm-svn: 74493
* - Add MemRegion::getMemorySpace()Ted Kremenek2009-06-231-27/+22
| | | | | | | | | | - Change implementation of MemRegion::hasStackStorage()/hasHeapStorage() to use 'getMemorySpace()'. This avoids a double traversal up the region hierarchy and is simpler. - Add MemRegion::hasHeapOrStackStorage() as a slightly more efficient alternative to 'hasStackStorage() || hasHeapStorage()'. llvm-svn: 73977
* Move 'hasStackStorage()' and 'hasHeapStorage()' from MemRegionManager to ↵Ted Kremenek2009-06-231-8/+8
| | | | | | MemRegion. llvm-svn: 73973
* MemRegionManager: Migrate logic for getCodeTextRegion() over to using Zhongxing Xu2009-06-231-28/+4
| | | | | | trait-based MemRegion creation. llvm-svn: 73941
* Remove duplicated methods.Zhongxing Xu2009-06-231-16/+20
| | | | llvm-svn: 73940
* MemRegions:Ted Kremenek2009-06-231-4/+16
| | | | | | | | - Embed a reference to MemRegionManager objects in MemSpaceRegion objects - Use this embedded reference for MemRegion objects to access ASTContext objects without external help - Use this access to ASTContext to simplify 'isBoundable' (no ASTContext& argument required) llvm-svn: 73935
* MemRegionManager: Migrate logic for getAllocaRegion() over to using ↵Ted Kremenek2009-06-231-16/+4
| | | | | | trait-based MemRegion creation. llvm-svn: 73927
* MemRegionManager: Migrate getObjCObjectRegion() and getTypedViewRegion() to useTed Kremenek2009-06-231-30/+3
| | | | | | the new trait-based construction of MemRegion objects. llvm-svn: 73926
* Migrate factory methods for FieldRegion and ObjCIVarRegion creation to use theTed Kremenek2009-06-221-28/+2
| | | | | | new generalized region-construction code. llvm-svn: 73921
* Refactor some of the logic in MemRegionManager for constructing regions usingTed Kremenek2009-06-221-70/+15
| | | | | | | | member template functions and traits. The idea is to allow MemRegionManager to construct subclasses of MemRegion that aren't declared in MemRegion.h (e.g., checker-specific regions). llvm-svn: 73917
* Use canonical type for building ElementRegion. Otherwise ElementRegions cannotZhongxing Xu2009-06-161-3/+5
| | | | | | be unique. llvm-svn: 73482
* rename: MemRegion:Zhongxing Xu2009-05-091-8/+0
| | | | | | | | | RValueType => ObjectType LValueType => LocationType No functionality change. llvm-svn: 71304
* The super region of ElementRegion no longer needs to be TypedRegion. In theZhongxing Xu2009-05-061-1/+1
| | | | | | future we would create ElementRegion directly on top of typeless regions. llvm-svn: 71075
* Per conversations with Zhongxing, add an 'element type' toTed Kremenek2009-05-041-17/+8
| | | | | | | | | | | | | | | | | | | ElementRegion. I also removed 'ElementRegion::getArrayRegion', although we may need to add this back. This breaks a few test cases with RegionStore: - 'array-struct.c' triggers an infinite recursion in RegionStoreManager. Need to investigate. - misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic: 'Line 159: Uninitialized or undefined return value returned to caller.' There were a bunch of places that needed to be edit RegionStoreManager, and we may not be passing all the correct 'element types' down from GRExprEngine. Zhongxing: When you get a chance, could you review this? I could have easily screwed up something basic in RegionStoreManager. llvm-svn: 70830
OpenPOWER on IntegriCloud