summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Split new/delete checker into use-after-free and leaks parts.Jordan Rose2013-04-052-3/+18
| | | | | | | | | | | | This splits the leak-checking part of alpha.cplusplus.NewDelete into a separate user-level checker, alpha.cplusplus.NewDeleteLeaks. All the difficult false positives we've seen with the new/delete checker have been spurious leak warnings; the use-after-free warnings and mismatched deallocator warnings, while rare, have always been valid. <rdar://problem/6194569> llvm-svn: 178890
* [analyzer] Path notes for the MismatchedDeallocator checker.Anton Yartsev2013-04-051-4/+8
| | | | llvm-svn: 178862
* [analyzer] Check allocation family more precise.Anton Yartsev2013-04-051-4/+4
| | | | | | | | | The statement passed to isTrackedFamily() might be a user defined function calling malloc; in this case we got AF_NONE family for this function. Now the allocation family is derived from Sym, that holds a family of a real allocator. This commit is also a movement towards getting rid of tracking memory allocating by unknown means. llvm-svn: 178834
* [analyzer] Corrected the switch statement.Anton Yartsev2013-04-051-6/+3
| | | | llvm-svn: 178831
* [analyzer] Fully-covered switch for families in isTrackedFamily()Anton Yartsev2013-04-051-7/+18
| | | | llvm-svn: 178820
* [analyzer] Reduced the unwanted correlations between checkers living inside ↵Anton Yartsev2013-04-041-89/+137
| | | | | | | | | | | | | MallocChecker.cpp This fixes an issue pointed to by Jordan: if unix.Malloc and unix.MismatchedDeallocator are both on, then we end up still tracking leaks of memory allocated by new. Moved the guards right before emitting the bug reports to unify and simplify the logic of handling of multiple checkers. Now all the checkers perform their checks regardless of if they were enabled, or not, and it is decided just before the emitting of the report, if it should be emitted. (idea from Anna). Additional changes: improved test coverage for checker correlations; refactoring: BadDealloc -> MismatchedDealloc llvm-svn: 178814
* [analyzer] RetainCountChecker: refactor annotation handling.Jordan Rose2013-04-041-63/+41
| | | | | | | | | ...and add a new test case. I thought this was broken, but it isn't; refactoring and reformatting anyway so that I don't make the same mistake again. No functionality change. llvm-svn: 178799
* [analyzer] Rename “Mac OS X API”, “Mac OS API” -> “API Misuse ↵Anna Zaks2013-04-033-4/+5
| | | | | | | | (Apple)” As they are relevant on both Mac and iOS. llvm-svn: 178687
* [analyzer] Warn when nil receiver results in forming null referenceAnna Zaks2013-04-031-12/+19
| | | | | | This also allows us to ensure IDC/return null suppression gets triggered in such cases. llvm-svn: 178686
* [analyzer] Better model for copying of array fields in implicit copy ctors.Jordan Rose2013-04-031-12/+22
| | | | | | | | | | | | - Find the correct region to represent the first array element when constructing a CXXConstructorCall. - If the array is trivial, model the copy with a primitive load/store. - Don't warn about the "uninitialized" subscript in the AST -- we don't use the helper variable that Sema provides. <rdar://problem/13091608> llvm-svn: 178602
* [analyzer] Moving cplusplus.NewDelete to alpha.* for now.Anton Yartsev2013-04-021-5/+4
| | | | llvm-svn: 178529
* [analyzer] Document existence of ConstPointerEscape.Anna Zaks2013-03-281-0/+12
| | | | llvm-svn: 178311
* [analyzer] Add support for escape of const pointers and use it to allow ↵Anna Zaks2013-03-281-3/+40
| | | | | | | | | | | | | “newed” pointers to escape Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works for const pointers passed as a top level parameter into a function. We need to differentiate the const pointers escape from regular escape since the content pointed by const pointer will not change; if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers. This should suppress several false positives reported by the NewDelete checker on llvm codebase. llvm-svn: 178310
* [analyzer] Apply the suppression rules to the nil receiver only if the value ↵Anna Zaks2013-03-282-3/+4
| | | | | | | | | | | | | | participates in the computation of the nil we warn about. We should only suppress a bug report if the IDCed or null returned nil value is directly related to the value we are warning about. This was not the case for nil receivers - we would suppress a bug report that had an IDCed nil receiver on the path regardless of how it’s related to the warning. 1) Thread EnableNullFPSuppression parameter through the visitors to differentiate between tracking the value which is directly responsible for the bug and other values that visitors are tracking (ex: general tracking of nil receivers). 2) in trackNullOrUndef specifically address the case when a value of the message send is nil due to the receiver being nil. llvm-svn: 178309
* Use early return in printing logic. Minor cleanup.Ted Kremenek2013-03-281-2/+4
| | | | llvm-svn: 178264
* Fix order of initialization warning.Eric Christopher2013-03-281-1/+1
| | | | llvm-svn: 178255
* [analyzer] These implements unix.MismatchedDeallocatorChecker checker.Anton Yartsev2013-03-282-75/+301
| | | | | | | | + Improved display names for allocators and deallocators The checker checks if a deallocation function matches allocation one. ('free' for 'malloc', 'delete' for 'new' etc.) llvm-svn: 178250
* [analyzer] For now assume all standard global 'operator new' functions ↵Anton Yartsev2013-03-281-3/+6
| | | | | | | | allocate memory in heap. + Improved test coverage for cplusplus.NewDelete checker. llvm-svn: 178244
* [analyzer] Ensure that the node NilReceiverBRVisitor is looking for is not ↵Anna Zaks2013-03-271-3/+4
| | | | | | | | | reclaimed The visitor should look for the PreStmt node as the receiver is nil in the PreStmt and this is the node. Also, tag the nil receiver nodes with a special tag for consistency. llvm-svn: 178152
* [analyzer] Make sure IDC works for ‘NSContainer value/key is nil’ checks.Anna Zaks2013-03-261-0/+1
| | | | | | | | | Register the nil tracking visitors with the region and refactor trackNullOrUndefValue a bit. Also adds the cast and paren stripping before checking if the value is an OpaqueValueExpr or ExprWithCleanups. llvm-svn: 178093
* [analyzer] Adds cplusplus.NewDelete checker that check for memory leaks, ↵Anton Yartsev2013-03-252-27/+144
| | | | | | double free, and use-after-free problems of memory managed by new/delete. llvm-svn: 177849
* [analyzer] Warn when a nil key or value are passed to NSMutableDictionary ↵Anna Zaks2013-03-231-16/+62
| | | | | | and ensure it works with subscripting. llvm-svn: 177789
* [analyzer] Print return values from debug.DumpCalls checker.Jordan Rose2013-03-211-1/+23
| | | | | | Debug utility only, no functionality change. llvm-svn: 177649
* [analyzer] Warn when a ‘nil’ object is added to NSArray or NSMutableArray.Anna Zaks2013-03-181-4/+33
| | | | llvm-svn: 177318
* [analyzer] Address a TODO in the StreamChecker; otherwise the output is ↵Anna Zaks2013-03-151-2/+1
| | | | | | non-deterministic. llvm-svn: 177207
* [analyzer] fixed the logic changed by r176949Anton Yartsev2013-03-131-4/+5
| | | | llvm-svn: 176956
* Refactoring:Anton Yartsev2013-03-131-34/+55
| | | | | | | | | + Individual Report* method for each bug type + Comment improved: missing non-trivial alloca() case annotated + 'range' parameter of ReportBadFree() capitalized + 'SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol();' shorten to 'SymbolRef Sym = C.getSVal(A).getAsSymbol();' llvm-svn: 176949
* [analyzer] Rename AttrNonNullChecker -> NonNullParamCheckerAnna Zaks2013-03-094-14/+17
| | | | llvm-svn: 176755
* [analyzer] Be more consistent about Objective-C methods that free memory.Jordan Rose2013-03-091-54/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, MallocChecker's pointer escape check and its post-call state update for Objective-C method calls had a fair amount duplicated logic and not-entirely-consistent checks. This commit restructures all this to be more consistent and possibly allow us to be more aggressive in warning about double-frees. New policy (applies to system header methods only): (1) If this is a method we know about, model it as taking/holding ownership of the passed-in buffer. (1a) ...unless there's a "freeWhenDone:" parameter with a zero (NO) value. (2) If there's a "freeWhenDone:" parameter (but it's not a method we know about), treat the buffer as escaping if the value is non-zero (YES) and non-escaping if it's zero (NO). (3) If the first selector piece ends with "NoCopy" (but it's not a method we know about and there's no "freeWhenDone:" parameter), treat the buffer as escaping. The reason that (2) and (3) don't explicitly model the ownership transfer is because we can't be sure that they will actually free the memory using free(), and we wouldn't want to emit a spurious "mismatched allocator" warning (coming in Anton's upcoming patch). In the future, we may have an idea of a "generic deallocation", i.e. we assume that the deallocator is correct but still continue tracking the region so that we can warn about double-frees. Patch by Anton Yartsev, with modifications from me. llvm-svn: 176744
* [analyzer] Warn on passing a reference to null pointer as an argument in a callAnna Zaks2013-03-071-23/+74
| | | | | | | | | | | | Warn about null pointer dereference earlier when a reference to a null pointer is passed in a call. The idea is that even though the standard might allow this, reporting the issue earlier is better for diagnostics (the error is reported closer to the place where the pointer was set to NULL). This also simplifies analyzer’s diagnostic logic, which has to track “where the null came from”. As a consequence, some of our null pointer warning suppression mechanisms started triggering more often. TODO: Change the name of the file and class to reflect the new check. llvm-svn: 176612
* [analyzer] Check for returning null references in ReturnUndefChecker.Jordan Rose2013-03-071-30/+66
| | | | | | | | | | | | | | | | | Officially in the C++ standard, a null reference cannot exist. However, it's still very easy to create one: int &getNullRef() { int *p = 0; return *p; } We already check that binds to reference regions don't create null references. This patch checks that we don't create null references by returning, either. <rdar://problem/13364378> llvm-svn: 176601
* [analyzer] Pass the correct Expr to the bug reporter visitors when dealing ↵Anna Zaks2013-03-061-3/+10
| | | | | | | | with CompoundLiteralExpr This allows us to trigger the IDC visitor in the added test case. llvm-svn: 176577
* [analyzer] Don't let cf_audited_transfer override CFRetain semantics.Jordan Rose2013-03-041-6/+6
| | | | | | | | | | We weren't treating a cf_audited_transfer CFRetain as returning +1 because its name doesn't contain "Create" or "Copy". Oops! Fortunately, the standard definitions of these functions are not marked audited. <rdar://problem/13339601> llvm-svn: 176463
* [analyzer] StackAddrEscapeChecker: strip qualifiers from temporary types.Jordan Rose2013-02-261-10/+11
| | | | | | | | | | | | With the new support for trivial copy constructors, we are not always consistent about whether a CXXTempObjectRegion gets reused or created from scratch, which affects whether qualifiers are preserved. However, we probably don't care anyway. This also switches to using the current PrintingPolicy for the type, which means C++ types don't get a spurious 'struct' prefix anymore. llvm-svn: 176068
* [analyzer] Restrict ObjC type inference to methods that have related result ↵Anna Zaks2013-02-251-30/+32
| | | | | | | | | | | | type. This addresses a case when we inline a wrong method due to incorrect dynamic type inference. Specifically, when user code contains a method from init family, which creates an instance of another class. Use hasRelatedResultType() to find out if our inference rules should be triggered. llvm-svn: 176054
* [analyzer] tracking stores/constraints now works for ObjC ivars or struct ↵Ted Kremenek2013-02-241-0/+8
| | | | | | | | | | | | | | | | | | | | | | | fields. This required more changes than I originally expected: - ObjCIvarRegion implements "canPrintPretty" et al - DereferenceChecker indicates the null pointer source is an ivar - bugreporter::trackNullOrUndefValue() uses an alternate algorithm to compute the location region to track by scouring the ExplodedGraph. This allows us to get the actual MemRegion for variables, ivars, fields, etc. We only hand construct a VarRegion for C++ references. - ExplodedGraph no longer drops nodes for expressions that are marked 'lvalue'. This is to facilitate the logic in the previous bullet. This may lead to a slight increase in size in the ExplodedGraph, which I have not measured, but it is likely not to be a big deal. I have validated each of the changed plist output. Fixes <rdar://problem/12114812> llvm-svn: 175988
* Add "KnownSVal" to represent SVals that cannot be UnknownSVal.Ted Kremenek2013-02-241-4/+4
| | | | | | | This provides a few sundry cleanups, and allows us to provide a compile-time check for a case that was a runtime assertion. llvm-svn: 175987
* Remove the CFGElement "Invalid" state.David Blaikie2013-02-233-10/+10
| | | | | | | | | | | | | Use Optional<CFG*> where invalid states were needed previously. In the one case where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy CFGAutomaticObjDtor. Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek and Doug Gregor. Post commit code review feedback on r175796 by Ted Kremenek. llvm-svn: 175938
* Add back implicitly dropped const.David Blaikie2013-02-211-1/+1
| | | | | | | (found due to incoming improvements to llvm::cast machinery that will error on this sort of mistake) llvm-svn: 175817
* Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie2013-02-2110-32/+29
| | | | | | See r175462 for another example/more details. llvm-svn: 175812
* Replace CFGElement llvm::cast support to be well-defined.David Blaikie2013-02-213-8/+8
| | | | | | See r175462 for another example/more details. llvm-svn: 175796
* Avoid implicit conversions of Optional<T> to bool.David Blaikie2013-02-211-1/+1
| | | | | | | This is a precursor to making Optional<T>'s operator bool 'explicit' when building Clang & LLVM as C++11. llvm-svn: 175722
* Use None rather than Optional<T>() where possible.David Blaikie2013-02-211-1/+1
| | | | llvm-svn: 175705
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-2014-66/+54
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Remove redundant Optional type in favor of llvm::OptionalDavid Blaikie2013-02-201-24/+4
| | | | llvm-svn: 175678
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-2023-185/+189
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* Disable dead stores checker for template instantations. Fixes ↵Ted Kremenek2013-02-181-0/+9
| | | | | | <rdar://problem/13213575>. llvm-svn: 175425
* objective-C: synthesize properties in order of theirFariborz Jahanian2013-02-141-1/+2
| | | | | | | | declarations to synthesize their ivars in similar determinstic order so they are laid out in a determinstic order. // rdar://13192366 llvm-svn: 175214
* Remove some stray uses of <ctype.h> functions.Jordan Rose2013-02-091-1/+2
| | | | | | These are causing assertions on some MSVC builds. llvm-svn: 174805
* [analyzer] Invalidation checker: move the "missing implementation" checkAnna Zaks2013-02-091-12/+13
| | | | | | | | | | | | The missing definition check should be in the same category as the missing ivar validation - in this case, the intent is to invalidate in the given class, as described in the declaration, but the implementation does not perform the invalidation. Whereas the MissingInvalidationMethod checker checks the cases where the method intention is not to invalidate. The second checker has potential to have a much higher false positive rate. llvm-svn: 174787
OpenPOWER on IntegriCloud