summaryrefslogtreecommitdiffstats
path: root/clang/lib/Analysis/RegionStore.cpp
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix:Ted Kremenek2009-09-271-52/+81
| | | | | | | | | | | | | | | | <rdar://problem/6914474> checker doesn't realize that variable might have been assigned if a pointer to that variable was passed to another function via a structure The problem here was the RegionStoreManager::InvalidateRegion didn't invalidate the bindings of invalidated regions. This required a rewrite of this method using a worklist. As part of this fix, changed ValueManager::getConjuredSymbolVal() to require a 'void*' SymbolTag argument. This tag is used to differentiate two different symbols created at the same location. llvm-svn: 82920
* Fix crash in RegionStoreManager::Bind() by using 'getAs<PointerType>()' ↵Ted Kremenek2009-09-241-1/+1
| | | | | | instead of 'cast<PointerType>()' (to handle pointer typedefs). llvm-svn: 82686
* Fix: <rdar://problem/7249340> [RegionStore] model stores to symbolic ↵Ted Kremenek2009-09-241-6/+22
| | | | | | | | | | parameter regions The issue was a discrepancy between how RegionStoreManager::Bind() and RegionStoreManager::Retrieve() derived the "key" for the first element of a symbolic region. llvm-svn: 82680
* Fix: <rdar://problem/7242006> [RegionStore] compound literal assignment with ↵Ted Kremenek2009-09-221-4/+5
| | | | | | floats not honored llvm-svn: 82575
* Change all the Type::getAsFoo() methods to specializations of Type::getAs().John McCall2009-09-211-1/+1
| | | | | | | | | | | Several of the existing methods were identical to their respective specializations, and so have been removed entirely. Several more 'leaf' optimizations were introduced. The getAsFoo() methods which imposed extra conditions, like getAsObjCInterfacePointerType(), have been left in place. llvm-svn: 82501
* Provide intermediate solution to handling assignments to structs via anTed Kremenek2009-09-211-0/+4
| | | | | | | | integer pointer. For now just invalidate the fields of the struct. This addresses: <rdar://problem/7185607> [RegionStore] support invalidation of bit fields using integer assignment llvm-svn: 82492
* Remove tabs, and whitespace cleanups.Mike Stump2009-09-091-252/+252
| | | | llvm-svn: 81346
* Fix buffer overflow reported in PR 4903.Ted Kremenek2009-09-051-5/+8
| | | | llvm-svn: 81092
* Handle pointer arithmetic in RegionStoreManager involving Objective-C pointersTed Kremenek2009-08-251-2/+8
| | | | | | when using the non-fragile Objective-C ABI. This fixes <rdar://problem/7168531>. llvm-svn: 80047
* Fix crash reported in <rdar://problem/7124210> by "back-porting" some of theTed Kremenek2009-08-251-14/+0
| | | | | | | implicit cast logic in RegionStoreManager to BasicStoreManager. This involved moving CastRetriedVal from RegionStoreManager to StoreManager. llvm-svn: 80026
* Remove 'SelfRegion' field from both BasicStoreManager and RegionStoreManager.Ted Kremenek2009-08-211-36/+3
| | | | | | | | | | | | | | | | | | SelfRegion represented the object bound to 'self' (when analyzing Objective-C methods) upon entry to a method. Having this region stored on the side ignores the current stack frame that we might be analyzing (among other things), and is a problem for interprocedural analysis. For RegionStoreManager, the value for SelfRegion is just lazily created. For BasicStoreManager, the value for SelfRegion is bound eagerly to 'self', but no explicit tracking of SelfRegion on the side is made. As part of this change, remove the restriction in BasicStoreManager that we only track ivars for 'self'. This shouldn't actually change anything in terms of precision, and simplifies the logic. llvm-svn: 79694
* Add LocationContext* field to VarRegion. This is needed for interprocedural ↵Ted Kremenek2009-08-211-12/+18
| | | | | | analysis. llvm-svn: 79680
* Eagerly bind 'self' to SelfRegion. Thus we do not need to get code decl fromZhongxing Xu2009-08-211-19/+25
| | | | | | GRStateManager to create the SelfRegion. llvm-svn: 79628
* To make the analysis independent on the locally stored liveness and cfgZhongxing Xu2009-08-171-1/+3
| | | | | | | of GRStateManager and GRExprEngine, pass the initial location context to the getInitialState() method. llvm-svn: 79228
* Fix a few more false positives involving RegionStore and unions, but this timeTed Kremenek2009-08-061-85/+55
| | | | | | | with array accesses. In the process, refactor some common logic in RetrieveElement() and RetrieveField() into RetrieveFieldOrElementCommon(). llvm-svn: 78349
* Fix a couple false positive "uninitialized value" warnings with RegionStoreTed Kremenek2009-08-061-1/+22
| | | | | | involving reasoning about unions (which we don't handle yet). llvm-svn: 78342
* I have a dream, one day, we won't need to do this.Mike Stump2009-08-061-0/+1
| | | | llvm-svn: 78305
* Refactor RegionStoreManager::RemoveDeadBindings to also scan the bindings of ↵Ted Kremenek2009-08-061-93/+154
| | | | | | LazyCompoundSVals. llvm-svn: 78284
* Remove unimplemented methods 'AddRegionView' and 'RemoveRegionView'. They ↵Ted Kremenek2009-08-061-10/+0
| | | | | | are no longer needed. llvm-svn: 78280
* Completely remove the code using region cast.Zhongxing Xu2009-08-061-59/+0
| | | | llvm-svn: 78273
* Implement lazy "copying" of structures and arrays in RegionStore. WhileTed Kremenek2009-08-061-37/+168
| | | | | | | | | | | | | | | | RegionStore already lazily abstracted the contents of arrays and structs, when doing an assignment from one array/struct to another we did an explicit element-wise copy, which resulted in a loss of laziness and huge performance problem when analyzing many code bases. Now RegionStoreManager handles such assignments using a new SVal could 'LazyCompoundSVal', which basically means the value of a given struct or array (a MemRegion*) in a specific state (GRState). When we do a load from a field whose encompassing struct binds to a LazyCompoundSVal, we essentially do a field lookup in the original structure. This means we have essentially zero copying of data for structs/arrays and everything stays lazy. llvm-svn: 78268
* Use feedback from RegionStoreSubRegionMap::add() to prune off adding a superTed Kremenek2009-08-051-7/+11
| | | | | | region to the worklist used to create the subregion map. llvm-svn: 78228
* Fix a bug in RegionStoreSubRegionManager::add() where multiple subregions ↵Ted Kremenek2009-08-051-2/+4
| | | | | | wouldn't correctly get registered in the SubRegion map. llvm-svn: 78162
* Handle disgusting corner case where a byte is loaded from the address of a ↵Ted Kremenek2009-08-031-1/+3
| | | | | | function. llvm-svn: 78000
* Remove RegionViews and RegionCasts. These are no longer used.Ted Kremenek2009-08-021-135/+4
| | | | llvm-svn: 77876
* RegionStoreManager::RemoveDeadBindings() now removes dead 'default' bindings ↵Ted Kremenek2009-08-021-2/+32
| | | | | | as well. llvm-svn: 77875
* Generalize the interface of 'StoreManager::RemoveDeadBindings()' to ↵Ted Kremenek2009-08-021-7/+8
| | | | | | manipulate the entire GRState, not just the Store. llvm-svn: 77870
* This is a fairly large patch, which resulted from a cascade of changesTed Kremenek2009-08-011-115/+231
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | made to RegionStore (and related classes) in order to handle some analyzer failures involving casts and manipulation of symbolic memory. The root of the change is in StoreManager::CastRegion(). Instead of using ad hoc heuristics to decide when to layer an ElementRegion on a casted MemRegion, we now always layer an ElementRegion when the cast type is different than the original type of the region. This carries the current cast information associated with a region around without resorting to the error prone recording of "casted types" in GRState. Along with this new policy of layering ElementRegions, I added a new algorithm to strip away existing ElementRegions when they simply represented casts of a base memory object. This algorithm computes the raw "byte offset" that an ElementRegion represents from the base region, and allows the new ElementRegion to be based off that offset. The added benefit is that this naturally handles a series of casts of a MemRegion without building up a set of redundant ElementRegions (thus canonicalizing the region view). Other related changes that cascaded from this one (as tests were failing in RegionStore): - Revamped RegionStoreManager::InvalidateRegion() to completely remove all bindings and default values from a region and all subregions. Now invalidated fields are not bound directly to new symbolic values; instead the base region has a "default" symbol value from which "derived symbols" can be created. The main advantage of this approach is that it allows us to invalidate a region hierarchy and then lazily instantiate new values no matter how deep the hierarchy went (i.e., regardless of the number of field accesses, e.g. x->f->y->z->...). The previous approach did not do this. - Slightly reworked RegionStoreManager::RemoveDeadBindings() to also incorporate live symbols and live regions that do not have direct bindings but also have "default values" used for lazy instantiation. The changes to 'InvalidateRegion' revealed that these were necessary in order to achieve lazy instantiation of values in the region store with those bindings being removed too early. - The changes to InvalidateRegion() and RemoveDeadBindings() revealed a serious bug in 'getSubRegionMap()' where not all region -> subregion relationships involved in actually bindings (explicit and implicit) were being recorded. This has been fixed by using a worklist algorithm to iteratively fill in the region map. - Added special support to RegionStoreManager::Bind()/Retrieve() to handle OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the layering of ElementRegions. - Fixed a bug in SymbolReaper::isLive() where derived symbols were not being marked live if the symbol they were derived from was also live. This fix was critical for getting lazy instantiation in RegionStore to work. - Tidied up the implementation of ValueManager::getXXXSymbolVal() methods to use SymbolManager::canSymbolicate() to decide whether or not a symbol should be symbolicated. - 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been moved to 'test/Analysis/misc-ps.m'. - Tweaked some pretty-printing of MemRegions, and implemented 'ElementRegion::getRawOffset()' for use with the CastRegion changes. llvm-svn: 77782
* Change uses of:Ted Kremenek2009-07-291-11/+11
| | | | | | | | | | | | | | | | | | | | Type::getAsReferenceType() -> Type::getAs<ReferenceType>() Type::getAsRecordType() -> Type::getAs<RecordType>() Type::getAsPointerType() -> Type::getAs<PointerType>() Type::getAsBlockPointerType() -> Type::getAs<BlockPointerType>() Type::getAsLValueReferenceType() -> Type::getAs<LValueReferenceType>() Type::getAsRValueReferenceType() -> Type::getAs<RValueReferenceType>() Type::getAsMemberPointerType() -> Type::getAs<MemberPointerType>() Type::getAsReferenceType() -> Type::getAs<ReferenceType>() Type::getAsTagType() -> Type::getAs<TagType>() And remove Type::getAsReferenceType(), etc. This change is similar to one I made a couple weeks ago, but that was partly reverted pending some additional design discussion. With Doug's pending smart pointer changes for Types, it seemed natural to take this approach. llvm-svn: 77510
* Remove 'StoreManager::OldCastRegion()', TypedViewRegion (which onlyTed Kremenek2009-07-291-9/+1
| | | | | | | OldCastRegion used), and the associated command line option '-analyzer-store=old-basic-cast'. llvm-svn: 77509
* Make StoreManager::InvalidateRegion() virtual, move the current implementationTed Kremenek2009-07-291-0/+100
| | | | | | | | | | in StoreManager to RegionStoreManager, and create a special, highly reduced version in BasicStoreManager. These changes are in preparation for future RegionStore-specific changes to InvalidateRegion. llvm-svn: 77483
* Temporarily disable most use of region casts in RegionStoreManager,Ted Kremenek2009-07-221-8/+32
| | | | | | | | | | | | | | | | instead preferring to use the a region's actual type when creating symbols and using the QualType passed to Retrieve for implicit casting. This preprocessor logic is temporary; eventually we will either remove region casts or keep them. Temporarily toggle (via preprocessor directives) that SymbolicRegions with heap storage are not undefined, but instead should be symbolicated. If we want to model that a SymbolicRegion is uninitialized, we can explicitly model that by binding UndefinedVal to that region. It turns out that we want to treat most heap objects as being defined, not the other way around. llvm-svn: 76720
* Fix PR 4594 by refactoring almost all casting logic from GRExprEngine::VisitCastTed Kremenek2009-07-211-29/+27
| | | | | | | | | to SValuator::EvalCast. In the process, the StoreManagers now use this new cast machinery, and the hack in GRExprEngine::EvalBind to handle implicit casts involving OSAtomicCompareAndSwap and friends has been removed (and replaced with logic closer to the logic specific to those functions). llvm-svn: 76641
* RegionStore:Ted Kremenek2009-07-211-11/+35
| | | | | | | | | | -refactor logic for retrieving bindings from VarDecls into RegionStoreManager::RetrieveVar() - improve RegionStoreManager::CastRetrievedVal() and SimpleSValuate::EvalCastNL to better handle casts of values of the same canonical type as well as casts of LocAsInteger values. llvm-svn: 76516
* Enhanced IsReinterpreted() (RegionStore.cpp) to reason about higher-orderTed Kremenek2009-07-201-13/+48
| | | | | | | | | | | | | pointers. Enhanced RegionStoreManager::Retrieve() to handle automatic casts when the loaded value is different from the requested value. This should be refined over time, but essentially we should always symbolicate locations as locations, and convert them to non-locations on demand. These changes now cause 'misc-ps.m' to pass again. llvm-svn: 76497
* Per offline discussion with Steve Naroff, add back Type::getAsXXXType() methodsTed Kremenek2009-07-171-8/+8
| | | | | | | | | until Doug Gregor's Type smart pointer code lands (or more discussion occurs). These methods just call the new Type::getAs<XXX> methods, so we still have reduced implementation redundancy. Having explicit getAsXXXType() methods makes it easier to set breakpoints in the debugger. llvm-svn: 76193
* Replaced Type::getAsLValueReferenceType(), Type::getAsRValueReferenceType(), ↵Ted Kremenek2009-07-171-1/+1
| | | | | | Type::getAsMemberPointerType(), Type::getAsTagType(), and Type::getAsRecordType() with their Type::getAs<XXX> equivalents. llvm-svn: 76139
* Add member template 'Type::getAs<T>', which converts a Type* to a respective T*.Ted Kremenek2009-07-161-7/+7
| | | | | | | | | | | | | | | | | | | | | This method is intended to eventually replace the individual Type::getAsXXXType<> methods. The motivation behind this change is twofold: 1) Reduce redundant implementations of Type::getAsXXXType() methods. Most of them are basically copy-and-paste. 2) By centralizing the implementation of the getAs<Type> logic we can more smoothly move over to Doug Gregor's proposed canonical type smart pointer scheme. Along with this patch: a) Removed 'Type::getAsPointerType()'; now clients use getAs<PointerType>. b) Removed 'Type::getAsBlockPointerTypE()'; now clients use getAs<BlockPointerType>. llvm-svn: 76098
* Move RegionStoreManager over to using newTed Kremenek2009-07-161-61/+28
| | | | | | | | ValueManager::makeArrayIndex()/convertArrayIndex() methods. This handles yet another crash case when reasoning about array indices of different bitwidth and signedness. llvm-svn: 75884
* Use utility method to create 0-index into ElementRegion.Ted Kremenek2009-07-161-2/+2
| | | | llvm-svn: 75865
* Enhance RegionStore's reasoning about Objective-C ivars. More testing to ↵Ted Kremenek2009-07-151-16/+40
| | | | | | follow. llvm-svn: 75748
* Use utility method.Zhongxing Xu2009-07-151-1/+1
| | | | llvm-svn: 75745
* Relax assertion.Ted Kremenek2009-07-151-1/+2
| | | | llvm-svn: 75738
* More test cases revealed that the logic in StoreManager::InvalidateRegion() ↵Ted Kremenek2009-07-151-4/+24
| | | | | | | | | | | | | | | | | needs more finesse when handling the invalidation of pointers. Pointers that were invalidated as integers could later cause problems for clients using them as pointers. It is easier for us to model a symbolic value as a pointer rather than modeling a non-symbolic value as a pointer. This patch causes: - StoreManager::InvalidateRegion() to not used the casted type of a region if it would cause a pointer type to be invalidated as a non-pointer type. - Pushes RegionStore::RetrieveElement() further by handling retrievals from symbolic arrays that have been invalidated. This uses the new SymbolDerived construct that was recently introduced. The result is that the failing test in misc-ps-region-store-x86_64.m now passes. Both misc-ps-region-store-x86_64.m and misc-ps-region-store-i386.m contain a test case that motivated this change. llvm-svn: 75730
* Enhance RegionStoreManager to handle 'Retrieve's from SymbolicRegions. We ↵Ted Kremenek2009-07-141-2/+8
| | | | | | do this by silently wrapping the region with an ElementRegion. This fixes the failures in misc-ps-region-store.m. llvm-svn: 75679
* Instead of recovering from a wrong invalidation, this patch aims to Zhongxing Xu2009-07-141-0/+32
| | | | | | | | invalidate the region correctly. It uses the cast-to type to invalidate the region when available. To avoid invalid cast-to type like 'void*' or 'id', region store now only records non-generic casts of regions. llvm-svn: 75580
* Tidy pretty-printing for SVals, using 'dump()' instead of 'printStdErr()', ↵Ted Kremenek2009-07-131-4/+2
| | | | | | and implementing operator<< support for llvm::raw_ostream. llvm-svn: 75560
* Change pretty-printing API for SymExprs and MemRegions to use a naming ↵Ted Kremenek2009-07-131-1/+1
| | | | | | convention and style similar to other elements in Clang. llvm-svn: 75548
* Restructure RegionStoreManager::EvalBinOp() as a switch dispatch over differentTed Kremenek2009-07-111-33/+59
| | | | | | | MemRegion kinds. This allows the compiler to identify what MemRegions we don't handle for pointer arithmetic. llvm-svn: 75326
* Restructure RegionStoreManager::getSizeInElements() to use a switch statementTed Kremenek2009-07-101-52/+67
| | | | | | | over the types of MemRegions. This allows the compiler to warn us which regions are not handled, and also is a little faster. llvm-svn: 75304
OpenPOWER on IntegriCloud