summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Fix MacOSXAPIChecker fp with static locals seen from nested blocks.Artem Dergachev2017-01-251-1/+8
| | | | | | | | | | | | | | This is an attempt to avoid new false positives caused by the reverted r292800, however the scope of the fix is significantly reduced - some variables are still in incorrect memory spaces. Relevant test cases added. rdar://problem/30105546 rdar://problem/30156693 Differential revision: https://reviews.llvm.org/D28946 llvm-svn: 293043
* [StaticAnalyzer] Fix android buildPavel Labath2017-01-161-1/+2
| | | | | | | | std::to_string is not available in the android NDK. Use llvm::to_string instead. Committing as obvious. llvm-svn: 292141
* [analyzer] Add LocationContext as a parameter to checkRegionChangesAnna Zaks2017-01-135-21/+21
| | | | | | | | | | | This patch adds LocationContext to checkRegionChanges and removes wantsRegionChangeUpdate as it was unused. A patch by Krzysztof Wiśniewski! Differential Revision: https://reviews.llvm.org/D27090 llvm-svn: 291869
* [analyzer] Fix false positives in Keychain API checkerAnna Zaks2017-01-131-83/+89
| | | | | | | | | | | | | | The checker has several false positives that this patch addresses: - Do not check if the return status has been compared to error (or no error) at the time when leaks are reported since the status symbol might no longer be alive. Instead, pattern match on the assume and stop tracking allocated symbols on error paths. - The checker used to report error when an unknown symbol was freed. This could lead to false positives, let's not repot those. This leads to loss of coverage in double frees. - Do not enforce that we should only call free if we are sure that error was not returned and the pointer is not null. That warning is too noisy and we received several false positive reports about it. (I removed: "Only call free if a valid (non-NULL) buffer was returned") - Use !isDead instead of isLive in leak reporting. Otherwise, we report leaks for objects we loose track of. This change triggered change #1. This also adds checker specific dump to the state. Differential Revision: https://reviews.llvm.org/D28330 llvm-svn: 291866
* [analyzer] Don't dereference the array value when binding it to a reference.Artem Dergachev2017-01-121-6/+0
| | | | | | | | | | This replaces the hack in r291754, which was fixing pr31592, which was caused by r291754, with a more appropriate solution. rdar://problem/28832541 Differential revision: https://reviews.llvm.org/D28602 llvm-svn: 291781
* [analyzer] Avoid a crash in DereferenceChecker on string literal initializers.Artem Dergachev2017-01-121-0/+6
| | | | | | | | | | | | A hotfix for pr31592 that fixes the crash but not the root cause of the problem. We need to update the analyzer engine further to account for AST changes introduced in r289618. At the moment we're erroneously performing a redundant lvalue-to-rvalue cast in this scenario, and squashing the rvalue of the object bound to the reference into the reference itself. rdar://problem/28832541 llvm-svn: 291754
* [analyzer] Add checker for iterators dereferenced beyond their range.Gabor Horvath2017-01-092-0/+843
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D25660 llvm-svn: 291430
* Migrate PathDiagnosticPiece to std::shared_ptrDavid Blaikie2017-01-0512-96/+102
| | | | | | | Simplifies and makes explicit the memory ownership model rather than implicitly passing/acquiring ownership. llvm-svn: 291143
* [analyzer] Update GTestChecker to tighten API detectionDevin Coughlin2016-12-221-36/+48
| | | | | | | | | Update the GTestChecker to tighten up the API detection and make it cleaner in response to post-commit feedback. Also add tests for when temporary destructors are enabled to make sure we get the expected behavior when inlining constructors for temporaries. llvm-svn: 290352
* [analyzer] Add checker modeling gtest APIs.Devin Coughlin2016-12-192-0/+288
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gtest is a widely-used unit-testing API. It provides macros for unit test assertions: ASSERT_TRUE(p != nullptr); that expand into an if statement that constructs an object representing the result of the assertion and returns when the assertion is false: if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr)) ; else return ...; Unfortunately, the analyzer does not model the effect of the constructor precisely because (1) the copy constructor implementation is missing from the the header (so it can't be inlined) and (2) the boolean-argument constructor is constructed into a temporary (so the analyzer decides not to inline it since it doesn't reliably call temporary destructors right now). This results in false positives because the analyzer does not realize that the the assertion must hold along the non-return path. This commit addresses the false positives by explicitly modeling the effects of the two un-inlined constructors on the AssertionResult state. I've added a new package, "apiModeling", for these kinds of checkers that model APIs but don't emit any diagnostics. I envision all the checkers in this package always being on by default. This addresses the false positives reported in PR30936. Differential Revision: https://reviews.llvm.org/D27773 rdar://problem/22705813 llvm-svn: 290143
* [analyzer] UnixAPIChecker: Don't diagnose for functions in C++ namespacesDevin Coughlin2016-12-171-0/+6
| | | | | | | | | | Update the UnixAPIChecker to not diagnose for calls to functions that are declared in C++ namespaces. This avoids false positives when a namespaced function has the same name as a Unix API. This address PR28331. llvm-svn: 290023
* [analyzer] Extend UnixAPIChecker open() checks to handle openat().Devin Coughlin2016-12-161-11/+80
| | | | | | | | | The openat() API has similar constraints to the open() API -- it just takes an extra parameter. rdar://problem/29526458 llvm-svn: 290005
* [analyzer] Fix crash in MallocChecker.Devin Coughlin2016-12-161-2/+1
| | | | | | | | | | | | | Fix a crash in the MallocChecker when the extent size for the argument to new[] is not known. A patch by Abramo Bagnara and Dániel Krupp! https://reviews.llvm.org/D27849 Differential Revision: https://reviews.llvm.org/D27849 llvm-svn: 289970
* [analyzer] Add another exception for Qt in MallocCheckerArtem Dergachev2016-12-161-0/+5
| | | | | | | | | | Treat pointers passed to QObject::connectImpl() as escaping. rdar://problem/29550440 Differential Revision: https://reviews.llvm.org/D27717 llvm-svn: 289939
* [analyzer] Refine the diagnostics in the nullability checker to ↵Anna Zaks2016-12-151-5/+10
| | | | | | | | | | | | differentiate between nil and null This is a big deal for ObjC, where nullability annotations are extensively used. I've also changed "Null" -> "null" and removed "is" as this is the pattern that Sema is using. Differential Revision: https://reviews.llvm.org/D27600 llvm-svn: 289885
* [analyzer] Include type name in Retain Count Checker diagnosticsAnna Zaks2016-12-151-2/+14
| | | | | | | | | The more detailed diagnostic will make identifying which object the diagnostics refer to easier. Differential Revision: https://reviews.llvm.org/D27740 llvm-svn: 289883
* [analyzer] Detect ObjC properties that are both (copy) and Mutable.Artem Dergachev2016-12-132-0/+83
| | | | | | | | | | | | | | | When an Objective-C property has a (copy) attribute, the default setter for this property performs a -copy on the object assigned. Calling -copy on a mutable NS object such as NSMutableString etc. produces an immutable object, NSString in our example. Hence the getter becomes type-incorrect. rdar://problem/21022397 Differential Revision: https://reviews.llvm.org/D27535 llvm-svn: 289554
* [analyzer] Improve VirtualCallChecker diagnostics and move into optin package.Devin Coughlin2016-12-101-38/+83
| | | | | | | | | | | | | | | | | | The VirtualCallChecker is in alpha because its interprocedural diagnostics represent the call path textually in the diagnostic message rather than with a path sensitive diagnostic. This patch turns off the AST-based interprocedural analysis in the checker so that no call path is needed and improves with diagnostic text. With these changes, the checker is ready to be moved into the optin package. Ultimately the right fix is to rewrite this checker to be path sensitive -- but there is still value in enabling the checker for intraprocedural analysis only The interprocedural mode can be re-enabled with an -analyzer-config flag. Differential Revision: https://reviews.llvm.org/D26768 llvm-svn: 289309
* [analyzer] Add dispatch_data_create as a special case in RetainCountChecker.Artem Dergachev2016-12-081-1/+4
| | | | | | | | | | | | | This function receives a callback block. The analyzer suspects that this block may be used to take care of releasing the libdispatch object returned from the function. In fact, it doesn't - it only releases the raw data buffer. Inform the analyzer about that. Fixes the resulting false negatives. rdar://problem/22280098 Differential Revision: https://reviews.llvm.org/D27409 llvm-svn: 289047
* [analyzer] Fix typo in nullability checker diagnosticDevin Coughlin2016-12-071-1/+1
| | | | | | 'infered' --> 'inferred' llvm-svn: 288922
* [analyzer] Remove an unused enum value in RetainCountChecker.Artem Dergachev2016-12-071-9/+8
| | | | | | | | No functional change intended. Differential Revision: https://reviews.llvm.org/D27408 llvm-svn: 288917
* [analyzer] pr31226: Disable CastSizeChecker in C++ because it's not quite ready.Artem Dergachev2016-12-071-1/+6
| | | | | | | | Avoids a crash and a related false positive. Investigation by Daniel Krupp! llvm-svn: 288914
* [analyzer] ObjCGenerics: Warn only on mismatch for invariant type parametersDevin Coughlin2016-12-051-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | On a method call, the ObjCGenerics checker uses the type tracked by DynamicTypePropagation for the receiver to to infer substituted parmeter types for the called methods and warns when the argument type does not match the parameter. Unfortunately, using the tracked type can result in false positives when the receiver has a non-invariant type parameter and has been intentionally upcast. For example, becaue NSArray's type parameter is covaraint, the following code is perfectly safe: NSArray<NSString *> *allStrings = ... NSDate *date = ...; NSArray<NSObject *> *allObjects = allStrings; NSArray<NSObject *> *moreObjects = [allObjects arrayByAddingObject:date]; but the checker currently warns that the date parameter is not an NSString *. To avoid this kind of false positive, the checker will now only warn when the class defining the called method has only invariant type parameters. rdar://problem/28803951 llvm-svn: 288677
* [analyzer] Minor fixes and improvements to debug.ExprInspectionArtem Dergachev2016-11-301-14/+91
| | | | | | | | | | | | | | | | | | - Fix the bug with transition handling in ExprInspectionChecker's checkDeadSymbols implementation. - Test this bug by adding a new function clang_analyzer_numTimesReached() to catch number of passes through the code, which should be handy for testing against unintended state splits. - Add two more functions should help debugging issues quickly without running the debugger or dumping exploded graphs - clang_analyzer_dump() which dump()s an SVal argument to a warning message, and clang_analyzer_printState(), which dump()s the current program state to stderr. Differential Revision: https://reviews.llvm.org/D26835 llvm-svn: 288257
* [analyzer] Remove unused check::RegionChanges::wantsRegionChangeUpdate callbackAnna Zaks2016-11-162-10/+0
| | | | | | | | | | | Remove the check::RegionChanges::wantsRegionChangeUpdate callback as it is no longer used (since checkPointerEscape has been added). A patch by Krzysztof Wiśniewski! Differential Revision: https://reviews.llvm.org/D26759 llvm-svn: 287175
* [analyzer] NumberObjectConversion: Workaround for a linker error with modules.Artem Dergachev2016-11-151-19/+19
| | | | | | | | | | A combination of C++ modules, variadic functions with more than one argument, and const globals in headers (all three being necessary) causes some releases of clang to misplace the matcher objects, which causes the linker to fail. No functional change - the extra allOf() matcher is no-op here. llvm-svn: 287045
* [analyzer] Add check for when block is called with too few arguments.Devin Coughlin2016-11-151-8/+13
| | | | | | | | | The CallAndMessageChecker has an existing check for when a function pointer is called with too few arguments. Extend this logic to handle the block case, as well. While we're at it, do a drive-by grammar correction ("less" --> "fewer") on the diagnostic text. llvm-svn: 287001
* [analyzer] Rename assumeWithinInclusiveRange*()Dominic Chen2016-11-151-4/+4
| | | | | | | | | | | | Summary: The name is slightly confusing, since the constraint is not necessarily within the range unless `Assumption` is true. Split out renaming for ConstraintManager.h from D26061 Reviewers: zaks.anna, dcoughlin Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D26644 llvm-svn: 286927
* [analyzer] Fix crash in NullabilityChecker calling block with too few argumentsDevin Coughlin2016-11-141-3/+4
| | | | | | | | | Fix a crash when checking parameter nullability on a block invocation with fewer arguments than the block declaration requires. rdar://problem/29237566 llvm-svn: 286901
* [analyzer] Update 'Automated' to 'Automatic' from r286694.Devin Coughlin2016-11-121-1/+1
| | | | | | ARC is 'Automatic Reference Counting' and not 'Automated Reference Counting'. llvm-svn: 286700
* [analyzer] Improve misleading RetainCountChcker diagnostic under ARCDevin Coughlin2016-11-121-4/+9
| | | | | | | | | | | | | | | | | | | | Under automated reference counting the analyzer treats a methods -- even those starting with 'copy' and friends -- as returning an unowned value. This is because ownership of CoreFoundation objects must be transferred to ARC with __bridge_transfer or CFBridgingRelease() before being returned as ARC-managed bridged objects. Unfortunately this could lead to a poor diagnostic inside copy methods under ARC where the analyzer would complain about a leak of a returned CF value inside a method "whose name does not start with 'copy'" -- even though the name did start with 'copy'. This commit improves the diagnostic under ARC to say inside a method "returned from a method managed by Automated Reference Counting". rdar://problem/28849667 llvm-svn: 286694
* [analyzer] Teach RetainCountChecker about VTCompressionSessionEncodeFrame()Devin Coughlin2016-11-111-0/+8
| | | | | | | | | | | | | | | The context argument passed to VideoToolbox's VTCompressionSessionEncodeFrame() function is ultimately passed to a callback supplied when creating the compression session and so may be freed by that callback. To suppress false positives in this case, teach the retain count checker to stop tracking that argument. This isn't suppressed by the usual callback context mechanism because the call to VTCompressionSessionEncodeFrame() doesn't include the callback itself. rdar://problem/27685213 llvm-svn: 286633
* [analyzer] StdLibraryFunctions: provide platform-specific function summaries.Artem Dergachev2016-11-021-57/+168
| | | | | | | | | | Because standard functions can be defined differently on different platforms, this commit introduces a method for constructing summaries with multiple variants, whichever matches better. It is also useful for supporting overloads. Differential Revision: https://reviews.llvm.org/D25940 llvm-svn: 285852
* [analyzer] Fix capitalization in ObjCSuperDealloc checker diagnostic.Devin Coughlin2016-11-011-1/+1
| | | | | | | | | Change "use of 'self'..." to "Use of 'self'...". The convention is to start diagnostics with a capital letter. rdar://problem/28322494 llvm-svn: 285759
* [analyzer] MacOSXAPIChecker: Improve warnings for __block vars in dispatch_once.Artem Dergachev2016-10-311-2/+10
| | | | | | | | | | The checker already warns for __block-storage variables being used as a dispatch_once() predicate, however it refers to them as local which is not quite accurate, so we fix that. Differential Revision: https://reviews.llvm.org/D26159 llvm-svn: 285637
* [analyzer] MacOSXAPIChecker: Disallow dispatch_once_t in ivars and heap.Artem Dergachev2016-10-311-15/+48
| | | | | | | | | | Unlike global/static variables, calloc etc. functions that allocate ObjC objects behave differently in terms of memory barriers, and hacks that make dispatch_once as fast as it possibly could be start failing. Differential Revision: https://reviews.llvm.org/D25909 llvm-svn: 285605
* Add support for __builtin_alloca_with_alignDavid Majnemer2016-10-312-0/+9
| | | | | | | | | | __builtin_alloca always uses __BIGGEST_ALIGNMENT__ for the alignment of the allocation. __builtin_alloca_with_align allows the programmer to specify the alignment of the allocation. This fixes PR30658. llvm-svn: 285544
* [analyzer] NumberObjectConversion: support more types, misc updates.Artem Dergachev2016-10-311-94/+175
| | | | | | | | | | | | | | | Support CFNumberRef and OSNumber objects, which may also be accidentally converted to plain integers or booleans. Enable explicit boolean casts by default in non-pedantic mode. Improve handling for warnings inside macros. Improve error messages. Differential Revision: https://reviews.llvm.org/D25731 llvm-svn: 285533
* [analyzer] Report CFNumberGetValue API misuseAnna Zaks2016-10-261-35/+42
| | | | | | | | | | | | This patch contains 2 improvements to the CFNumber checker: - Checking of CFNumberGetValue misuse. - Treating all CFNumber API misuse errors as non-fatal. (Previously we treated errors that could cause uninitialized memory as syncs and the truncation errors as non-fatal.) This implements a subset of functionality from https://reviews.llvm.org/D17954. Differential Revision: https://reviews.llvm.org/D25876 llvm-svn: 285253
* Fix MSVC unused variable warning.Simon Pilgrim2016-10-251-1/+2
| | | | | | LLVM_ATTRIBUTE_UNUSED doesn't work for non-gcc style compilers. llvm-svn: 285067
* [analyzer] Use unsigned integers to rely on well-defined overflow semantics.Artem Dergachev2016-10-241-5/+5
| | | | | | Found by the UBSan buildbot. llvm-svn: 285000
* [analyzer] Add StdLibraryFunctions checker.Artem Dergachev2016-10-242-0/+944
| | | | | | | | | | | | | | | This checker does not emit reports, however it influences the analysis by providing complete summaries for, or otherwise improving modeling of, various standard library functions. This should reduce the number of infeasible paths explored during analysis. The custom function summary format used in this checker is superior to body farms by causing less unnecessary state splits, which would result in better analysis performance. Differential Revision: https://reviews.llvm.org/D20811 llvm-svn: 284960
* alpha.core.UnreachableCode - don't warn about unreachable code inside macroDaniel Marjamaki2016-10-181-0/+8
| | | | | | | | In macros, 'do {...} while (0)' is often used. Don't warn about the condition 0 when it is unreachable. Differential Revision: https://reviews.llvm.org/D25606 llvm-svn: 284477
* [analyzer] Add NumberObjectConversion checker.Artem Dergachev2016-10-182-0/+268
| | | | | | | | | | | | | | | | | When dealing with objects that represent numbers, such as Objective-C NSNumber, the language provides little protection from accidentally interpreting the value of a pointer to such object as the value of the number represented by the object. Results of such mis-interpretation may be unexpected. The checker attempts to fill this gap in cases when the code is obviously incorrect. With "Pedantic" option enabled, this checker enforces a coding style to completely prevent errors of this kind (off by default). Differential Revision: https://reviews.llvm.org/D22968 llvm-svn: 284473
* Revert "Revert "[analyzer] Make MallocChecker more robust against custom ↵Devin Coughlin2016-10-161-0/+4
| | | | | | | | | redeclarations"" This reverts commit r284340 to reapply r284335. The bot breakage was due to an unrelated change in the polybench test suite. llvm-svn: 284351
* Revert "[analyzer] Make MallocChecker more robust against custom redeclarations"Devin Coughlin2016-10-161-4/+0
| | | | | | | | | | This reverts commit r284335. It appears to be causing test-suite compile-time and execution-time performance measurements to take longer than expected on several bots. This is surprising, because r284335 is a static-analyzer-only change. llvm-svn: 284340
* [analyzer] Make MallocChecker more robust against custom redeclarationsDevin Coughlin2016-10-161-0/+4
| | | | | | | | | | | | | Add additional checking to MallocChecker to avoid crashing when memory routines have unexpected numbers of arguments. You wouldn't expect to see much of this in normal code (-Wincompatible-library-redeclaration warns on this), but, for example, CMake tests can generate these. This is PR30616. rdar://problem/28631974 llvm-svn: 284335
* Revert "[analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker""Devin Coughlin2016-10-161-35/+3
| | | | | | | | | | | | Revert: r283662: [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker" r283660: [analyzer] Fix build error after r283660 - remove constexpr strings. It was causing an internal build bot to fail. It looks like in some cases adding an extra note can cause scan-build plist output to drop a diagnostic altogether. llvm-svn: 284317
* [analyzer] Link libStaticAnalyzerCheckers to libASTMatchers.Artem Dergachev2016-10-131-0/+1
| | | | | | | | | | | | | AST matchers are useful for the analyzer's checkers. More patches on particular checkers shall follow. This is the first time clang binary gets linked to ASTMatchers. The binary size increase for the clang executable would be +0.5% in release mode, +2% in debug mode. Differential Revision: https://reviews.llvm.org/D25429 llvm-svn: 284112
* [analyzer] DeallocChecker: Don't warn about directly-set IBOutlet ivars on macOSDevin Coughlin2016-10-121-0/+31
| | | | | | | | | | | | | | | | On macOS (but not iOS), if an ObjC property has no setter, the nib-loading code for an IBOutlet is documented as directly setting the backing ivar without retaining the value -- even if the property is 'retain'. This resulted in false positives from the DeallocChecker for code that did not release such ivars in -dealloc. To avoid these false positives, treat IBOutlet ivars that back a property without a setter as having an unknown release requirement in macOS. rdar://problem/28507353 llvm-svn: 284084
OpenPOWER on IntegriCloud