summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "[analyzer] Reapply r271907 (2nd try)."Devin Coughlin2016-06-078-981/+0
| | | | | | | | Even with the fix in r271981, ASan is finding a stack use after return. This reverts commits r271977 and r271981. llvm-svn: 271984
* [analyzer] Speculative fix for r271907.Devin Coughlin2016-06-071-1/+1
| | | | | | | | Fix a compilation error on the bots involving brace initialization. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271981
* [analyzer] Reapply r271907 (2nd try).Devin Coughlin2016-06-078-0/+981
| | | | | | | | | | | | | | Second try at reapplying "[analyzer] Add checker for correct usage of MPI API in C and C++." Special thanks to Dan Liew for helping test the fix for the template specialization compiler error with gcc. The original patch is by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271977
* Revert "Reapply "[analyzer] Add checker for correct usage of MPI API in C ↵Devin Coughlin2016-06-068-981/+0
| | | | | | | | and C++."" This reverts commit r271914. It is still breaking bots. llvm-svn: 271920
* Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-068-0/+981
| | | | | | | | | Reapply r271907 with a fix for the compiler error with gcc about specializing clang::ento::ProgramStateTrait in a different namespace. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271914
* Revert "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-068-979/+0
| | | | | | | This reverts commit r271907. It broke a bunch of bots with compile errors about specializations in different namespaces. llvm-svn: 271909
* [analyzer] Add checker for correct usage of MPI API in C and C++.Devin Coughlin2016-06-068-0/+979
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to check for the correct usage of the MPI API in C and C++. 3 path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait. - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call. Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker Reviewers: zaks.anna A patch by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271907
* Apply clang-tidy's misc-move-constructor-init throughout Clang.Benjamin Kramer2016-05-275-6/+11
| | | | | | No functionality change intended, maybe a tiny performance improvement. llvm-svn: 270996
* [Analyzer] Correct stack address escape diagnosticSean Eveson2016-05-261-1/+6
| | | | | | | | | | | | | | | | | | Summary: Leaking a stack address via a static variable refers to it in the diagnostic as a 'global'. This patch corrects the diagnostic for static variables. Patch by Phil Camp, SN Systems Reviewers: dcoughlin, zaks.anna Subscribers: xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D19866 Patch by Phil Camp llvm-svn: 270849
* [analyzer] Fix for PR23790 : constrain return value of strcmp() rather than ↵Anton Yartsev2016-05-191-17/+20
| | | | | | | | | | returning a concrete value. The function strcmp() can return any value, not just {-1,0,1} : "The strcmp(const char *s1, const char *s2) function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by s1 is greater than, equal to, or less than the string pointed to by s2." [C11 7.24.4.2p3] https://llvm.org/bugs/show_bug.cgi?id=23790 http://reviews.llvm.org/D16317 llvm-svn: 270154
* [analyzer] Fix crash in ObjCGenericsCheckerDevin Coughlin2016-05-111-0/+25
| | | | | | | | | | | | | | | Fix a crash in the generics checker where DynamicTypePropagation tries to get the superclass of a root class. This is a spot-fix for a deeper issue where the checker makes assumptions that may not hold about subtyping between the symbolically-tracked type of a value and the compile-time types of a cast on that value. I've added a TODO to address the underlying issue. rdar://problem/26086914 llvm-svn: 269227
* [analyzer] Add path note for localizability checker.Devin Coughlin2016-04-281-0/+64
| | | | | | | | | Add a path note indicating the location of the non-localized string literal in NonLocalizedStringChecker. rdar://problem/25981525 llvm-svn: 267924
* [analyzer] Move Checkers.inc to clang/include/...Chih-Hung Hsieh2016-04-284-658/+2
| | | | | | | | Simplify sharing of Checkers.inc with other files like ClangTidy.cpp. Differential Revision: http://reviews.llvm.org/19393 llvm-svn: 267832
* [analyzer] Let TK_PreserveContents span across the whole base region.Artem Dergachev2016-04-251-1/+1
| | | | | | | | | | | | If an address of a field is passed through a const pointer, the whole structure's base region should receive the TK_PreserveContents trait and avoid invalidation. Additionally, include a few FIXME tests shown up during testing. Differential Revision: http://reviews.llvm.org/D19057 llvm-svn: 267413
* [analyzer] Nullability: Suppress diagnostic on bind with cast.Devin Coughlin2016-04-131-6/+28
| | | | | | | | | | | | | | Update the nullability checker to allow an explicit cast to nonnull to suppress a warning on an assignment of nil to a nonnull: id _Nonnull x = (id _Nonnull)nil; // no-warning This suppression as already possible for diagnostics on returns and function/method arguments. rdar://problem/25381178 llvm-svn: 266219
* [analyzer] Nullability: Treat nil _Nonnull ivar as invariant violation.Devin Coughlin2016-04-131-14/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Treat a _Nonnull ivar that is nil as an invariant violation in a similar fashion to how a nil _Nonnull parameter is treated as a precondition violation. This avoids warning on defensive returns of nil on defensive internal checks, such as the following common idiom: @class InternalImplementation @interface PublicClass { InternalImplementation * _Nonnull _internal; } -(id _Nonnull)foo; @end @implementation PublicClass -(id _Nonnull)foo { if (!_internal) return nil; // no-warning return [_internal foo]; } @end rdar://problem/24485171 llvm-svn: 266157
* [analyzer] Nullability: Suppress return diagnostics in inlined functions.Devin Coughlin2016-04-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The nullability checker can sometimes miss detecting nullability precondition violations in inlined functions because the binding for the parameter that violated the precondition becomes dead before the return: int * _Nonnull callee(int * _Nonnull p2) { if (!p2) // p2 becomes dead here, so binding removed. return 0; // warning here because value stored in p2 is symbolic. else return p2; } int *caller(int * _Nonnull p1) { return callee(p1); } The fix, which is quite blunt, is to not warn about null returns in inlined methods/functions. This won’t lose much coverage for ObjC because the analyzer always analyzes each ObjC method at the top level in addition to inlined. It *will* lose coverage for C — but there aren’t that many codebases with C nullability annotations. rdar://problem/25615050 llvm-svn: 266109
* Remove redundant conditions of the form (A || (!A && B)) -> (A || B)Benjamin Kramer2016-04-111-2/+1
| | | | | | Found by cppcheck! PR27286 PR27287 PR27288 PR27289 llvm-svn: 265918
* [analyzer] Nullability: Don't warn along paths where null returned from ↵Devin Coughlin2016-03-281-55/+79
| | | | | | | | | | | | | | | | non-null. Change the nullability checker to not warn along paths where null is returned from a method with a non-null return type, even when the diagnostic for this return has been suppressed. This prevents warning from methods with non-null return types that inline methods that themselves return nil but that suppressed the diagnostic. Also change the PreconditionViolated state component to be called "InvariantViolated" because it is set when a post-condition is violated, as well. rdar://problem/25393539 llvm-svn: 264647
* [analyzer] Add CIFIlter modeling to DeallocChecker.Devin Coughlin2016-03-251-10/+56
| | | | | | | | | | | | | | | | | | | | The -dealloc method in CIFilter is highly unusual in that it will release instance variables belonging to its *subclasses* if the variable name starts with "input" or backs a property whose name starts with "input". Subclasses should not release these ivars in their own -dealloc method -- doing so could result in an over release. Before this commit, the DeallocChecker would warn about missing releases for such "input" properties -- which could cause users of the analyzer to add over releases to silence the warning. To avoid this, DeallocChecker now treats CIFilter "input-prefixed" ivars as MustNotReleaseDirectly and so will not require a release. Further, it will now warn when such an ivar is directly released in -dealloc. rdar://problem/25364901 llvm-svn: 264463
* [analyzer] Fix typo s/initalize/initialize/Chih-Hung Hsieh2016-03-231-1/+1
| | | | | | Differential Revision: http://reviews.llvm.org/D18363 llvm-svn: 264164
* StaticAnalyzer: Avoid an unintentional copyJustin Bogner2016-03-221-1/+1
| | | | | | | | | | The range here isn't over references, so using `auto &` here incites a copy. Switching to `auto *` would do, but we might as well list an explicit type for clarity. Found by -Wrange-loop-analysis. llvm-svn: 264071
* [analyzer] Fix missed leak from MSVC specific allocation functionsAnna Zaks2016-03-081-13/+23
| | | | | | | | | | | | Add the wide character strdup variants (wcsdup, _wcsdup) and the MSVC version of alloca (_alloca) and other differently named function used by the Malloc checker. A patch by Alexander Riccio! Differential Revision: http://reviews.llvm.org/D17688 llvm-svn: 262894
* [analyzer] Nullability: add option to not report on calls to system headers.Devin Coughlin2016-03-051-2/+25
| | | | | | | | | | | | | | Add an -analyzer-config 'nullability:NoDiagnoseCallsToSystemHeaders' option to the nullability checker. When enabled, this option causes the analyzer to not report about passing null/nullable values to functions and methods declared in system headers. This option is motivated by the observation that large projects may have many nullability warnings. These projects may find warnings about nullability annotations that they have explicitly added themselves higher priority to fix than warnings on calls to system libraries. llvm-svn: 262763
* [analyzer] Add diagnostic in ObjCDeallocChecker for use of -dealloc instead ↵Devin Coughlin2016-03-041-32/+92
| | | | | | | | | | | | | | | | | | of -release. In dealloc methods, the analyzer now warns when -dealloc is called directly on a synthesized retain/copy ivar instead of -release. This is intended to find mistakes of the form: - (void)dealloc { [_ivar dealloc]; // Mistaken call to -dealloc instead of -release [super dealloc]; } rdar://problem/16227989 llvm-svn: 262729
* Move class into anonymous namespace. NFC.Benjamin Kramer2016-03-041-0/+2
| | | | llvm-svn: 262716
* [analyzer] ObjCDeallocChecker: Only check for nil-out when type is retainable.Devin Coughlin2016-03-031-1/+5
| | | | | | This fixes a crash when setting a property of struct type in -dealloc. llvm-svn: 262659
* [analyzer] Move ObjCSuperDeallocChecker out of the alpha package.Devin Coughlin2016-03-021-4/+4
| | | | | | | | It will now be on by default on Darwin. rdar://problem/6953275 llvm-svn: 262526
* [analyzer] Move ObjCDeallocChecker out of the alpha package.Devin Coughlin2016-03-021-4/+4
| | | | | | | | It will now be on by default on Darwin. rdar://problem/6927496 llvm-svn: 262524
* [analyzer] Fix capitalization in ObjCSuperDeallocChecker diagnostic.Devin Coughlin2016-03-021-1/+1
| | | | llvm-svn: 262520
* [analyzer] Update CheckObjCDealloc diagnostic for missing -dealloc.Devin Coughlin2016-03-011-10/+18
| | | | | | | Update the diagnostic for classes missing -dealloc to mention an instance variable that needs to be released. llvm-svn: 262277
* [analyzer] Teach CheckObjCDealloc about Block_release().Devin Coughlin2016-02-291-10/+38
| | | | | | It now treats Block_release(b) as a release in addition to [b release]. llvm-svn: 262272
* [analyzer] Don't treat calls to system headers as escaping in CheckObjCDealloc.Devin Coughlin2016-02-291-21/+96
| | | | | | | | | | | | | | | | | | | This prevents false negatives when a -dealloc method, for example, removes itself as as an observer with [[NSNotificationCenter defaultCenter] removeObserver:self]. It is unlikely that passing 'self' to a system header method will release 'self''s instance variables, so this is unlikely to produce false positives. A challenge here is that while CheckObjCDealloc no longer treats these calls as escaping, the rest of the analyzer still does. In particular, this means that loads from the same instance variable before and after a call to a system header will result in different symbols being loaded by the region store. To account for this, the checker now treats different ivar symbols with the same instance and ivar decl as the same for the purpose of release checking and more eagerly removes a release requirement when an instance variable is assumed to be nil. This was not needed before because when an ivar escaped its release requirement was always removed -- now the requirement is not removed for calls to system headers. llvm-svn: 262261
* [analyzer] Prune some incorrect \param doc comment annotations.Devin Coughlin2016-02-262-15/+15
| | | | llvm-svn: 261970
* Checkers/CheckObjCDealloc.cpp: Prune "\param". [-Wdocumentation]NAKAMURA Takumi2016-02-261-1/+1
| | | | llvm-svn: 261963
* [analyzer] Shorten ObjcSuperDeallocChecker diagnostics.Devin Coughlin2016-02-261-2/+2
| | | | | | | | | Change "use of 'self' after it has been freed with call to [super dealloc]" to "use of 'self' after it has been deallocated" and "use of instance variable '_ivar' after the instance has been freed with call to [super dealloc]" to "use of instance variable '_ivar' after 'self' has been deallocated". llvm-svn: 261945
* [analyzer] Fix a memory error in r261935 caught by the Windows bots.Devin Coughlin2016-02-261-2/+2
| | | | | | It was using a temporary StringRef after its underlying storage was freed. llvm-svn: 261944
* [analyzer] Warn on use of 'self' after call to to [super dealloc].Devin Coughlin2016-02-251-24/+119
| | | | | | | | | | | | Referring to 'self' after a call to [super dealloc] is a use-after-free in Objective-C because NSObject's -dealloc frees the memory pointed to by self. This patch extends the ObjCSuperDeallocChecker to catch this error. rdar://problem/6953275 Differential Revision: http://reviews.llvm.org/D17528 llvm-svn: 261935
* [analyzer] Reapply r261917 with a fix.Devin Coughlin2016-02-251-175/+752
| | | | | | | | This reapplies "[analyzer] Make ObjCDeallocChecker path sensitive." (r261917) with a fix for an error on some bots about specializing a template from another namespace. llvm-svn: 261929
* Revert "[analyzer] Make ObjCDeallocChecker path sensitive."Devin Coughlin2016-02-251-748/+175
| | | | | | This reverts commit r261917. It broke the bots. llvm-svn: 261921
* [analyzer] Make ObjCDeallocChecker path sensitive.Devin Coughlin2016-02-251-175/+748
| | | | | | | | | | | | | | Convert the ObjCDeallocChecker to be path sensitive. The primary motivation for this change is to prevent false positives when -dealloc calls helper invalidation methods to release instance variables, but it additionally improves precision when -dealloc contains control flow. It also reduces the need for pattern matching. The check for missing -dealloc methods remains AST-based. Part of rdar://problem/6927496 Differential Revision: http://reviews.llvm.org/D17511 llvm-svn: 261917
* [analyzer] Improve pointer arithmetic checker.Gabor Horvath2016-02-231-25/+299
| | | | | | | | | | | This patch is intended to improve pointer arithmetic checker. From now on it only warns when the pointer arithmetic is likely to cause an error. For example when the pointer points to a single object, or an array of derived types. Differential Revision: http://reviews.llvm.org/D14203 llvm-svn: 261632
* [analyzer] Detect duplicate [super dealloc] callsDevin Coughlin2016-02-223-0/+202
| | | | | | | | | | | | | | Add an alpha path checker that warns about duplicate calls to [super dealloc]. This will form the foundation of a checker that will detect uses of 'self' after calling [super dealloc]. Part of rdar://problem/6953275. Based on a patch by David Kilzer! Differential Revision: http://reviews.llvm.org/D5238 llvm-svn: 261545
* [analyzer] Add checker callback for beginning of function.Devin Coughlin2016-02-192-1/+15
| | | | | | | | | | Add a checker callback that is called when the analyzer starts analyzing a function either at the top level or when inlined. This will be used by a follow-on patch making the DeallocChecker path sensitive. Differential Revision: http://reviews.llvm.org/D17418 llvm-svn: 261293
* Simplify users of StringRef::{l,r}trim (clang) (NFC)Vedant Kumar2016-02-162-2/+2
| | | | | | | r260925 introduced a version of the *trim methods which is preferable when trimming a single kind of character. Update all users in clang. llvm-svn: 260927
* [analyzer] Improve pattern matching in ObjCDealloc checker.Devin Coughlin2016-02-111-8/+17
| | | | | | | | Look through PseudoObjectExpr and OpaqueValueExprs when scanning for release-like operations. This commit also adds additional tests in anticipation of re-writing this as a path-sensitive checker. llvm-svn: 260608
* Fix some Clang-tidy readability-redundant-control-flow warnings; other minor ↵Eugene Zelenko2016-02-107-40/+19
| | | | | | | | fixes. Differential revision: http://reviews.llvm.org/D17060 llvm-svn: 260414
* [analyzer] Invalidate destination of std::copy() and std::copy_backward().Devin Coughlin2016-02-071-0/+58
| | | | | | | | | Now that the libcpp implementations of these methods has a branch that doesn't call memmove(), the analyzer needs to invalidate the destination for these methods explicitly. rdar://problem/23575656 llvm-svn: 260043
* [analyzer] DeallocChecker: Don't warn on release of readonly assign property ↵Devin Coughlin2016-02-061-0/+6
| | | | | | | | | in dealloc. It is common for the ivars for read-only assign properties to always be stored retained, so don't warn for a release in dealloc for the ivar backing these properties. llvm-svn: 259998
* [analyzer] Suppress localization diagnostics in debug classes and methods.Devin Coughlin2016-02-051-0/+35
| | | | | | | If the class or method name case-insensitively contains the term "debug", suppress warnings about string constants flowing to user-facing UI APIs. llvm-svn: 259875
OpenPOWER on IntegriCloud