summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Remove unnecessary code.Anna Zaks2012-08-241-16/+0
| | | | | | | | This code has been added a while ago and removing it does not trigger any test failures. The false positives it was trying to suppress are probably handled by other logic (ex: special handling of delegates). llvm-svn: 162529
* [analyzer] Make analyzer less aggressive when dealing with [self init].Anna Zaks2012-08-241-0/+29
| | | | | | | | | | | | | | With inlining, retain count checker starts tracking 'self' through the init methods. The analyser results were too noisy if the developer did not follow 'self = [super init]' pattern (which is common especially in older code bases) - we reported self init anti-pattern AND possible use-after-free. This patch teaches the retain count checker to assume that [super init] does not fail when it's not consumed by another expression. This silences the retain count warning that warns about possibility of use-after-free when init fails, while preserving all the other checking on 'self'. llvm-svn: 162508
* [analyzer] Fixup to r162399. Initialize the member variable.Anna Zaks2012-08-221-0/+2
| | | | llvm-svn: 162405
* [analyzer] Add osx.cocoa.NonNilReturnValue checker.Anna Zaks2012-08-222-0/+49
| | | | | | | | The checker adds assumptions that the return values from the known APIs are non-nil. Teach the checker about NSArray/NSMutableArray/NSOrderedSet objectAtIndex, objectAtIndexedSubscript. llvm-svn: 162398
* Rename 'unbindLoc()' (in ProgramState) and 'Remove()' toTed Kremenek2012-08-221-1/+1
| | | | | | | | | 'killBinding()'. The name is more specific, and one just forwarded to the other. Add some doxygen comments along the way. llvm-svn: 162350
* Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.Ted Kremenek2012-08-225-24/+16
| | | | | | | | | Also rename 'getCurrentBlockCounter()' to 'blockCount()'. This ripples a bunch of code simplifications; mostly aesthetic, but makes the code a bit tighter. llvm-svn: 162349
* Rename 'getConjuredSymbol*' to 'conjureSymbol*'.Ted Kremenek2012-08-223-9/+8
| | | | | | | | | | No need to have the "get", the word "conjure" is a verb too! Getting a conjured symbol is the same as conjuring one up. This shortening is largely cosmetic, but just this simple changed cleaned up a handful of lines, making them less verbose. llvm-svn: 162348
* Remove stale header file.Ted Kremenek2012-08-221-1/+0
| | | | llvm-svn: 162341
* [analyzer] Replace boolean IsSink parameters with 'generateSink' methods.Jordan Rose2012-08-202-5/+3
| | | | | | | | | | | Generating a sink is significantly different behavior from generating a normal node, and a simple boolean parameter can be rather opaque. Per offline discussion with Anna, adding new generation methods is the clearest way to communicate intent. No functionality change. llvm-svn: 162215
* [analyzer] Remove obsolete GenericNodeBuilderRefCount from RetainCountChecker.Jordan Rose2012-08-181-39/+16
| | | | | | | | | | This was once an adapter class between callbacks that had CheckerContexts and those that don't, but for a while now it's essentially just been a wrapper around a ProgramPointTag. We can just pass the tag around instead. No functionality change. llvm-svn: 162155
* [analyzer] If we call a C++ method on an object, assume it's non-null.Jordan Rose2012-08-151-3/+9
| | | | | | | | | | | | | | | | | | | | This is analogous to our handling of pointer dereferences: if we dereference a pointer that may or may not be null, we assume it's non-null from then on. While some implementations of C++ (including ours) allow you to call a non-virtual method through a null pointer of object type, it is technically disallowed by the C++ standard, and should not prune out any real paths in practice. [class.mfct.non-static]p1: A non-static member function may be called for an object of its class type, or for an object of a class derived from its class type... (a null pointer value does not refer to an object) We can also make the same assumption about function pointers. llvm-svn: 161992
* [analyzer] Correctly devirtualize virtual method calls in constructors.Jordan Rose2012-08-151-10/+60
| | | | | | | | | This is the other half of C++11 [class.cdtor]p4 (the destructor side was added in r161915). This also fixes an issue with post-call checks where the 'this' value was already being cleaned out of the state, thus being omitted from a reconstructed CXXConstructorCall. llvm-svn: 161981
* [analyzer] Correctly devirtualize virtual method calls in destructors.Jordan Rose2012-08-151-1/+36
| | | | | | | | | | | | C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
* [analyzer] Remove other #if 0 from Retain Count checker.Anna Zaks2012-08-141-37/+1
| | | | | | These date back to 2009, 2011. llvm-svn: 161876
* [analyzer] Remove autorelease pools code from the Retain Count checker.Anna Zaks2012-08-141-113/+0
| | | | llvm-svn: 161875
* [analyzer] Fixup to r161821Anna Zaks2012-08-141-3/+1
| | | | llvm-svn: 161854
* [analyzer] Disable autorelease pool tracking.Anna Zaks2012-08-141-2/+21
| | | | | | | | | The autorelease pool has not been implemented completely: we were adding the autoreleased symbols to the state, but never looking at them. Until we have a complete implementation, remove the overhead and comment out the unused code. llvm-svn: 161821
* [analyzer] Refactor RetainReleaseChecker to go through a function callAnna Zaks2012-08-141-40/+53
| | | | | | | | | | | to set/get/remove the RefBinding. No functional change here. Having these setter and getter methods will make it much easier when replacing the underlining representation of RefBindings (I just went through the exercise). It makes the code more readable as well. llvm-svn: 161820
* [analyzer] Add getStackFrame() to CheckerContext and ExplodedNode.Anna Zaks2012-08-141-1/+1
| | | | llvm-svn: 161819
* [analyzer] Add clang_analyzer_checkInlined for debugging purposes.Jordan Rose2012-08-101-38/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | This check is also accessible through the debug.ExprInspection checker. Like clang_analyzer_eval, you can use it to test the analyzer engine's current state; the argument should be true or false to indicate whether or not you expect the function to be inlined. When used in the positive case (clang_analyzer_checkInlined(true)), the analyzer prints the message "TRUE" if the function is ever inlined. However, clang_analyzer_checkInlined(false) should never print a message; this asserts that there should be no paths on which the current function is inlined, but then there are no paths on which to print a message! (If the assertion is violated, the message "FALSE" will be printed.) This asymmetry comes from the fact that the only other chance to print a message is when the function is analyzed as a top-level function. However, when we do that, we can't be sure it isn't also inlined elsewhere (such as in a recursive function, or if we want to analyze in both general or specialized cases). Rather than have all checkInlined calls have an appended, meaningless "FALSE" or "TOP-LEVEL" case, there is just no message printed. void clang_analyzer_checkInlined(int); For debugging purposes only! llvm-svn: 161708
* [analyzer] Track if a region can be a subclass in the dynamic type info.Anna Zaks2012-08-101-1/+1
| | | | | | | When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
* [analyzer] Rename the function to better reflect what it actually does.Anna Zaks2012-08-091-3/+3
| | | | llvm-svn: 161617
* [analyzer] Cleanup of malloc checker.Anna Zaks2012-08-091-22/+1
| | | | | | | Remove Escaped state, which is not really necessary. We can just stop tracking the symbol instead of keeping it around and marking escaped. llvm-svn: 161557
* clang support for Bitrig (an OpenBSD fork); patch by David Hill.Eli Friedman2012-08-081-0/+1
| | | | llvm-svn: 161546
* [analyzer] Clean up the printing of FieldRegions for leaks.Jordan Rose2012-08-081-3/+2
| | | | | | | | | | | | | | Unfortunately, generalized region printing is very difficult: - ElementRegions are used both for casting and as actual elements. - Accessing values through a pointer means going through an intermediate SymbolRegionValue; symbolic regions are untyped. - Referring to implicitly-defined variables like 'this' and 'self' could be very confusing if they come from another stack frame. We fall back to simply not printing the region name if we can't be sure it will print well. This will allow us to improve in the future. llvm-svn: 161512
* [analyzer] Track malloc'd regions stored in structs.Jordan Rose2012-08-081-16/+14
| | | | | | | | | | | The main blocker on this (besides the previous commit) was that ScanReachableSymbols was not looking through LazyCompoundVals. Once that was fixed, it's easy enough to clear out malloc data on return, just like we do when we bind to a global region. <rdar://problem/10872635> llvm-svn: 161511
* [analyzer] Address Jordan's review of DynamicTypePropagation.Anna Zaks2012-08-071-1/+2
| | | | llvm-svn: 161391
* [analyzer] Dynamic type info - propagate through implicit casts.Anna Zaks2012-08-061-2/+64
| | | | | | | | I currently have a bit of redundancy with the cast kind switch statement inside the ImplicitCast callback, but I might be adding more casts going forward. llvm-svn: 161358
* [analyzer] Add a checker to manage dynamic type propagation.Anna Zaks2012-08-063-0/+121
| | | | | | | | | | | | Instead of sprinkling dynamic type info propagation throughout ExprEngine, the added checker would add the more precise type information on known APIs (Ex: ObjC alloc, new) and propagate the type info in other cases (ex: ObjC init method, casts (the second is not implemented yet)). Add handling of ObjC alloc, new and init to the checker. llvm-svn: 161357
* [analyzer] Ignore OS X 10.8's annotations for NSMakeCollectable.Jordan Rose2012-08-061-1/+6
| | | | | | | | | | The frameworks correctly use the 'cf_consumed' and 'ns_returns_retained' attributes for NSMakeCollectable, but we can model the behavior under garbage collection more precisely than that. No functionality change. llvm-svn: 161349
* [analyzer] Malloc: remove assert since is not valid as of r161248Anna Zaks2012-08-041-5/+0
| | | | | | | We can be in the situation where we did not track the symbol before realloc was called on it. llvm-svn: 161294
* [analyzer] Use a more robust check for null in CallAndMessageChecker.Jordan Rose2012-08-041-2/+12
| | | | | | This should fix the failing test on the buildbot as well. llvm-svn: 161290
* [analyzer] Don't assume values bound to references are automatically non-null.Jordan Rose2012-08-041-3/+18
| | | | | | | | | | | While there is no such thing as a "null reference" in the C++ standard, many implementations of references (including Clang's) do not actually check that the location bound to them is non-null. Thus unlike a regular null dereference, this will not cause a problem at runtime until the reference is actually used. In order to catch these cases, we need to not prune out paths on which the input pointer is null. llvm-svn: 161288
* [analyzer] When a symbol is null, we should track its constraints.Jordan Rose2012-08-0314-42/+25
| | | | | | | | Because of this, we would previously emit NO path notes when a parameter is constrained to null (because there are no stores). Now we show where we made the assumption, which is much more useful. llvm-svn: 161280
* [analyzer] Track null/uninitialized C++ objects used in method calls.Jordan Rose2012-08-031-12/+12
| | | | llvm-svn: 161278
* [analyzer] Malloc: track non-allocated but freed memoryAnna Zaks2012-08-031-12/+4
| | | | | | | | | | There is no reason why we should not track the memory which was not allocated in the current function, but was freed there. This would allow to catch more use-after-free and double free with no/limited IPA. Also fix a realloc issue which surfaced as the result of this patch. llvm-svn: 161248
* [analyzer] Add a simple check for initializing reference variables with null.Jordan Rose2012-08-021-94/+152
| | | | | | | | | There's still more work to be done here; this doesn't catch reference parameters or return values. But it's a step in the right direction. Part of <rdar://problem/11212286>. llvm-svn: 161214
* [analyzer] Only allow CallEvents to be created by CallEventManager.Jordan Rose2012-07-301-2/+5
| | | | | | | | | | This ensures that it is valid to reference-count any CallEvents, and we won't accidentally try to reclaim a CallEvent that lives on the stack. It also hides an ugly switch statement for handling CallExprs! There should be no functionality change here. llvm-svn: 160986
* clang/lib: [CMake] Update tblgen'd dependencies.NAKAMURA Takumi2012-07-271-0/+1
| | | | llvm-svn: 160851
* [analyzer] Rename Calls.{h,cpp} to CallEvent.{h,cpp}. No functionality change.Jordan Rose2012-07-269-9/+9
| | | | llvm-svn: 160815
* Add static analyzer check for calling a C++ instance method with a ↵Ted Kremenek2012-07-261-2/+25
| | | | | | null/uninitialized pointer. llvm-svn: 160767
* Remove experimental invalid iterators checker from the codebase until we ↵Ted Kremenek2012-07-253-608/+0
| | | | | | | | | have the time to fix all the issues. Currently the code is essentially unmaintained and buggy, and needs major revision (with coupled enhancements to the analyzer core). llvm-svn: 160754
* Fix a typo (the the => the)Sylvestre Ledru2012-07-232-3/+3
| | | | llvm-svn: 160622
* [analyzer] Combine all ObjC message CallEvents into ObjCMethodCall.Jordan Rose2012-07-183-62/+83
| | | | | | | | | | | | As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
* Remove trivial destructor from SVal.Benjamin Kramer2012-07-182-2/+1
| | | | | | | | | | This enables the faster SmallVector in clang and also allows clang's unused variable warnings to be more effective. Fix the two instances that popped up. The RetainCountChecker change actually changes functionality, it would be nice if someone from the StaticAnalyzer folks could look at it. llvm-svn: 160444
* [analyzer] Add debug.DumpCalls, which prints out any CallEvents it sees.Jordan Rose2012-07-102-2/+33
| | | | | | | | | | This is probably not so useful yet because it is not path-sensitive, though it does try to show inlining with indentation. This also adds a dump() method to CallEvent, which should be useful for debugging. llvm-svn: 160030
* [analyzer] Guard against C++ member functions that look like system functions.Jordan Rose2012-07-105-43/+66
| | | | | | | | | C++ method calls and C function calls both appear as CallExprs in the AST. This was causing crashes for an object that had a 'free' method. <rdar://problem/11822244> llvm-svn: 160029
* [analyzer] Make CallEnter, CallExitBegin, and CallExitEnd not be StmtPointsJordan Rose2012-07-103-10/+23
| | | | | | | These ProgramPoints are used in inlining calls, and not all calls have associated statements anymore. llvm-svn: 160021
* [analyzer] Add a CXXDestructorCall CallEvent.Jordan Rose2012-07-101-0/+1
| | | | | | | | While this work is still fairly tentative (destructors are still left out of the CFG by default), we now handle destructors in the same way as any other calls, instead of just automatically trying to inline them. llvm-svn: 160020
* [analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints.Jordan Rose2012-07-102-1/+5
| | | | | | | | | | | | | | | | | These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
OpenPOWER on IntegriCloud