summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Remove redundant check (scalar type is a superset of integer)Anna Zaks2012-07-101-2/+1
| | | | | | PR13319 Reported by Jozsef Mihalicza. llvm-svn: 159996
* Implement AST classes for comments, a real parser for Doxygen comments and aDmitri Gribenko2012-07-061-0/+1
| | | | | | | | | | | | | | very simple semantic analysis that just builds the AST; minor changes for lexer to pick up source locations I didn't think about before. Comments AST is modelled along the ideas of HTML AST: block and inline content. * Block content is a paragraph or a command that has a paragraph as an argument or verbatim command. * Inline content is placed within some block. Inline content includes plain text, inline commands and HTML as tag soup. llvm-svn: 159790
* [analyzer] For now, don't inline non-static member overloaded operators.Jordan Rose2012-07-031-0/+1
| | | | | | | | | | | | | | Our current inlining support (specifically RegionStore::enterStackFrame) doesn't know that calls to overloaded operators may be calls to non-static member functions, and that in these cases the first argument should be treated as 'this'. This caused incorrect results and sometimes crashes. The long-term fix will be to rewrite RegionStore::enterStackFrame to use CallEvent and its subclasses, but for now we can just disable these problematic calls by classifying them under a new CallEvent, CXXMemberOperatorCall. llvm-svn: 159692
* [analyzer] Introduce CXXAllocatorCall to handle placement arg invalidation.Jordan Rose2012-07-021-0/+1
| | | | | | | This is NOT full-blown support for operator new, but removes some nasty duplicated code introduced in r158784. llvm-svn: 159608
* [analyzer] If 'super' is known to be nil, we can still mark its range.Jordan Rose2012-07-021-1/+1
| | | | llvm-svn: 159596
* [analyzer] Convert existing checkers to use check::preCall and check::postCall.Jordan Rose2012-07-024-201/+101
| | | | llvm-svn: 159563
* [analyzer] Add generic preCall and postCall checks.Jordan Rose2012-07-021-3/+33
| | | | llvm-svn: 159562
* [analyzer] Finish replacing ObjCMessage with ObjCMethodDecl and friends.Jordan Rose2012-07-029-151/+116
| | | | | | | | The preObjCMessage and postObjCMessage callbacks now take an ObjCMethodCall argument, which can represent an explicit message send (ObjCMessageSend) or an implicit message generated by a property access (ObjCPropertyAccess). llvm-svn: 159559
* [analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends.Jordan Rose2012-07-024-17/+25
| | | | | | | | | | | | Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper around the existing ObjCMessage abstraction (over message sends and property accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses ObjCMessageSend and ObjCPropertyAccess. In addition to removing yet another wrapper object, this should make it easy to add a ObjCSubscriptAccess call event soon. llvm-svn: 159558
* [analyzer] Move the last bits of CallOrObjCMessage over to CallEvent.Jordan Rose2012-07-021-27/+14
| | | | | | | | | | | | | This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
* [analyzer] Convert CallAndMessageChecker and ObjCSelfInitChecker to CallEvent.Jordan Rose2012-07-022-24/+68
| | | | | | | | | Both of these got uglier rather than cleaner because we don't have preCall and postCall yet; properly wrapping a CallExpr in a CallEvent requires doing a bit of deconstruction on the callee. Even when we have preCall and postCall we may want to expose the current CallEvent to pre/postStmt<CallExpr>. llvm-svn: 159556
* [analyzer] Convert RetainCountChecker to use CallEvent as much as possible.Jordan Rose2012-07-021-188/+237
| | | | | | | | | | | | | | | | | | | | | | | | | This ended allowing quite a bit of cleanup, and some minor changes. - CallEvent makes it easy to use hasNonZeroCallbackArg more aggressively, which we check in order to avoid false positives with callbacks that might release the object. - In order to support this for functions which consume their arguments, there are two new ArgEffects: DecRefAndStopTracking and DecRefMsgAndStopTracking. These act just like StopTracking, except that if the object only had a return count of +1 it's now considered released instead (so we still get use-after-free messages). - On the plus side, we no longer have to special-case +[NSObject performSelector:withObject:afterDelay:] and friends. - The use of IdentifierInfos in the method summary cache is now hidden; only the ObjCInterfaceDecl gets passed around most of the time. - Since we cache all "simple" summaries and check every function call, there is no real benefit to having NULL stand in for default summaries anymore. - Whitespace, unused methods, etc. Even more simplification to come when we get check::postCall and can unify all these other post* checks. llvm-svn: 159555
* [analyzer] Add a new abstraction over all types of calls: CallEventJordan Rose2012-07-024-134/+124
| | | | | | | | | | This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
* Revert "Tweak insecureAPI analyzer checks to have the ability to be ↵Ted Kremenek2012-06-291-2/+8
| | | | | | | | individually disabled." Jordan Rose corrected me that this actually isn't needed. llvm-svn: 159462
* Tweak insecureAPI analyzer checks to have the ability to be individually ↵Ted Kremenek2012-06-291-8/+2
| | | | | | | | | | | | disabled. The solution is a bit inefficient: it creates N checkers, one for each check, and each check does a dispatch on the function name. This is redundant, but we can fix this once we have the proper ability to enable/disable subchecks. Fixes <rdar://problem/11780180>. llvm-svn: 159459
* [analyzer] Add a test that we are, in fact, doing a DFS on the ExplodedGraph.Jordan Rose2012-06-293-0/+62
| | | | | | | | | | | | | | | | | | | | Previously: ...the comment said DFS... ...the WorkList being instantiated said BFS... ...and the implementation was actually DFS... ...due to an unintentional change in 2010... ...and everything kept working anyway. This fixes our std::deque implementation of BFS, but switches back to a SmallVector-based implementation of DFS. We should probably still investigate the ramifications of DFS vs. BFS, especially for large functions (and especially when we hit our block path limit), since this might completely change our memory use. It can also mask some bugs and reveal others depending on when we halt analysis. But at least we will not have this kind of little mistake creep in again. llvm-svn: 159397
* [analyzer] RetainCountChecker: remove unused SelfOwn ArgEffect kind.Jordan Rose2012-06-271-4/+1
| | | | llvm-svn: 159245
* [analyzer] Be careful about implicitly-declared operator new/delete. (PR13090)Jordan Rose2012-06-251-2/+1
| | | | | | | | The implicit global allocation functions do not have valid source locations, but we still want to treat them as being "system header" functions for the purposes of how they affect program state. llvm-svn: 159160
* [analyzer] Teach malloc checker that initWith[Bytes|Characters}NoCopy Anna Zaks2012-06-221-1/+3
| | | | | | relinquish memory. llvm-svn: 159043
* [analyzer] Fixup to r158958.Anna Zaks2012-06-221-2/+2
| | | | llvm-svn: 159037
* [analyzer] Malloc: Warn about use-after-free when memory ownership wasAnna Zaks2012-06-221-11/+73
| | | | | | transfered with dataWithBytesNoCopy. llvm-svn: 158958
* Remove a goofy CMake hack and use the standard CMake facilities toChandler Carruth2012-06-211-2/+6
| | | | | | | | | express library-level dependencies within Clang. This is no more verbose really, and plays nicer with the rest of the CMake facilities. It should also have no change in functionality. llvm-svn: 158888
* [analyzer] Malloc leak false positive: Allow xpc context to escape.Anna Zaks2012-06-201-0/+6
| | | | llvm-svn: 158875
* [analyzer] Malloc: cleanup, disallow free on relinquished memory.Anna Zaks2012-06-201-10/+17
| | | | | | | | This commits sets the grounds for more aggressive use after free checking. We will use the Relinquished sate to denote that someone else is now responsible for releasing the memory. llvm-svn: 158850
* [analyzer] Allow pointers to escape into NSPointerArray.Anna Zaks2012-06-191-0/+10
| | | | | | (Fixes radar://11691035 PR13140) llvm-svn: 158703
* [analyzer] Buffers passed to CGBitmapContextCreate can escape.Jordan Rose2012-06-161-5/+7
| | | | | | | | | | | | | | Specifically, although the bitmap context does not take ownership of the buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted out of the created CGContextRef. Thus the buffer is not leaked even if its original pointer goes out of scope, as long as - the context escapes, or - it is retrieved via CGBitmapContextGetData and freed. Actually implementing that logic is beyond the current scope of MallocChecker, so for now CGBitmapContextCreate goes on our system function exception list. llvm-svn: 158579
* [analyzer] RetainCount: don't track objects init'd with a delegateJordan Rose2012-06-151-4/+9
| | | | | | | | | We already didn't track objects that have delegates or callbacks or objects that are passed through void * "context pointers". It's a not-uncommon pattern to release the object in its callback, and so the leak message we give is not very helpful. llvm-svn: 158532
* Documentation cleanup:James Dennett2012-06-151-10/+12
| | | | | | | | | * Add \brief to produce a summary in the Doxygen output; * Add missing parameter names to \param commands; * Fix mismatched parameter names for \param commands; * Add a parameter name so that the \param has a target. llvm-svn: 158503
* [analyzer] Add ObjCLoopChecker: objects from NSArray et al are non-nil.Jordan Rose2012-06-112-0/+78
| | | | | | | | | | | | While collections containing nil elements can still be iterated over in an Objective-C for-in loop, the most common Cocoa collections -- NSArray, NSDictionary, and NSSet -- cannot contain nil elements. This checker adds that assumption to the analyzer state. This was the cause of some minor false positives concerning CFRelease calls on objects in an NSArray. llvm-svn: 158319
* [analyzer] When looking for a known class, only traverse the hierarchy once.Jordan Rose2012-06-111-48/+50
| | | | | | | | | This has a small hit in the case where only one class is interesting (NilArgChecker) but is a big improvement when looking for one of several interesting classes (VariadicMethodTypeChecker), in which the most common case is that there is no match. llvm-svn: 158318
* [analyzer] MallocSizeofChecker false positive: when sizeof is argumentAnna Zaks2012-06-081-5/+0
| | | | | | | | | | | | | | to addition. We should not to warn in case the malloc size argument is an addition containing 'sizeof' operator - it is common to use the pattern to pack values of different sizes into a buffer. Ex: uint8_t *buffer = (uint8_t*)malloc(dataSize + sizeof(length)); llvm-svn: 158219
* [analyzer] Anti-aliasing: different heap allocations do not aliasAnna Zaks2012-06-071-5/+13
| | | | | | | | | | | | Add a concept of symbolic memory region belonging to heap memory space. When comparing symbolic regions allocated on the heap, assume that they do not alias. Use symbolic heap region to suppress a common false positive pattern in the malloc checker, in code that relies on malloc not returning the memory aliased to other malloc allocations, stack. llvm-svn: 158136
* Revert Decl's iterators back to pointer value_type rather than reference ↵David Blaikie2012-06-064-8/+8
| | | | | | | | | | | | | | value_type In addition, I've made the pointer and reference typedef 'void' rather than T* just so they can't get misused. I would've omitted them entirely but std::distance likes them to be there even if it doesn't use them. This rolls back r155808 and r155869. Review by Doug Gregor incorporating feedback from Chandler Carruth. llvm-svn: 158104
* Remove unused private member variables found by clang's new ↵Benjamin Kramer2012-06-063-38/+19
| | | | | | -Wunused-private-field. llvm-svn: 158086
* Disable path pruning for UndefResultChecker. It turns out we usually want ↵Ted Kremenek2012-06-061-0/+2
| | | | | | | | to see more of the path to discover how a value was used uninitialized. llvm-svn: 158048
* Fix typos found by http://github.com/lyda/misspell-checkBenjamin Kramer2012-06-022-3/+3
| | | | llvm-svn: 157886
* Disable diagnosic path pruning for ReturnUndefChecker.Ted Kremenek2012-06-011-0/+1
| | | | llvm-svn: 157851
* [analyzer] Fix BugType memory leak in IdempotentOperationChecker.Tom Care2012-05-311-1/+4
| | | | llvm-svn: 157772
* Allow some BugReports to opt-out of PathDiagnostic callstack pruning until ↵Ted Kremenek2012-05-314-0/+4
| | | | | | | | | we have significantly improved the pruning heuristics. The current heuristics are pretty good, but they make diagnostics for uninitialized variables warnings particularly useless in some cases. llvm-svn: 157734
* Replace some custom hash combines with the standard stuff from DenseMapInfo.Benjamin Kramer2012-05-271-8/+5
| | | | llvm-svn: 157531
* [analyzer] Minor cleanup to checkers' help text.Anna Zaks2012-05-241-4/+4
| | | | llvm-svn: 157402
* [analyzer] Malloc checker: remove unnecessary comparisons.Anna Zaks2012-05-181-16/+10
| | | | llvm-svn: 157081
* [analyzer]Malloc: refactor and report use after free by memoryAnna Zaks2012-05-181-10/+57
| | | | | | allocating functions. llvm-svn: 157037
* [analyzer] Introduce clang_analyzer_eval for regression test constraint checks.Jordy Rose2012-05-163-0/+90
| | | | | | | | | | The new debug.ExprInspection checker looks for calls to clang_analyzer_eval, and emits a warning of TRUE, FALSE, or UNKNOWN (or UNDEFINED) based on the constrained value of its (boolean) argument. It does not modify the analysis state though the conditions tested can result in branches (e.g. through the use of short-circuit operators). llvm-svn: 156919
* [analyzer] Fix a regression in ObjCUnusedIVars checker.Anna Zaks2012-05-151-0/+9
| | | | | | | We can no longer rely on children iterator to visit all the AST tree children of an expression (OpaqueValueExpr has no children). llvm-svn: 156870
* [analyzer] strncpy: Special-case a length of 0 to avoid an incorrect warning.Jordy Rose2012-05-141-0/+18
| | | | | | | | | | We check the address of the last element accessed, but with 0 calculating that address results in element -1. This patch bails out early (and avoids a bunch of other work at that). Fixes PR12807. llvm-svn: 156769
* [analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose2012-05-121-0/+45
| | | | llvm-svn: 156699
* [analyzer] Do not highlight the range of the statement in case of leak.Anna Zaks2012-05-101-8/+24
| | | | | | | | | | We report a leak at a point a leaked variable is no longer accessible. The statement that happens to be at that point is not relevant to the leak diagnostic and, thus, should not be highlighted. radar://11178519 llvm-svn: 156530
* [analyzer] SelfInit: Stop tracking self if it's assigned a value weAnna Zaks2012-05-081-1/+25
| | | | | | | | | | | | | | don't reason about. Self is just like a local variable in init methods, so it can be assigned anything like result of static functions, other methods ... So to suppress false positives that result in such cases, stop tracking the checker-specific state after self is being assigned to (unless the value is't being assigned to is either self or conforms to our rules). This change does not invalidate any existing regression tests. llvm-svn: 156420
* Teach the static analyzer that NSLog() and friends do not hold on to object ↵Ted Kremenek2012-05-081-0/+6
| | | | | | references (thus extending their lifetime). llvm-svn: 156346
OpenPOWER on IntegriCloud