summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Add StdLibraryFunctions checker.Artem Dergachev2016-10-242-0/+944
| | | | | | | | | | | | | | | This checker does not emit reports, however it influences the analysis by providing complete summaries for, or otherwise improving modeling of, various standard library functions. This should reduce the number of infeasible paths explored during analysis. The custom function summary format used in this checker is superior to body farms by causing less unnecessary state splits, which would result in better analysis performance. Differential Revision: https://reviews.llvm.org/D20811 llvm-svn: 284960
* alpha.core.UnreachableCode - don't warn about unreachable code inside macroDaniel Marjamaki2016-10-181-0/+8
| | | | | | | | In macros, 'do {...} while (0)' is often used. Don't warn about the condition 0 when it is unreachable. Differential Revision: https://reviews.llvm.org/D25606 llvm-svn: 284477
* [analyzer] Add NumberObjectConversion checker.Artem Dergachev2016-10-182-0/+268
| | | | | | | | | | | | | | | | | When dealing with objects that represent numbers, such as Objective-C NSNumber, the language provides little protection from accidentally interpreting the value of a pointer to such object as the value of the number represented by the object. Results of such mis-interpretation may be unexpected. The checker attempts to fill this gap in cases when the code is obviously incorrect. With "Pedantic" option enabled, this checker enforces a coding style to completely prevent errors of this kind (off by default). Differential Revision: https://reviews.llvm.org/D22968 llvm-svn: 284473
* Revert "Revert "[analyzer] Make MallocChecker more robust against custom ↵Devin Coughlin2016-10-161-0/+4
| | | | | | | | | redeclarations"" This reverts commit r284340 to reapply r284335. The bot breakage was due to an unrelated change in the polybench test suite. llvm-svn: 284351
* Revert "[analyzer] Make MallocChecker more robust against custom redeclarations"Devin Coughlin2016-10-161-4/+0
| | | | | | | | | | This reverts commit r284335. It appears to be causing test-suite compile-time and execution-time performance measurements to take longer than expected on several bots. This is surprising, because r284335 is a static-analyzer-only change. llvm-svn: 284340
* [analyzer] Make MallocChecker more robust against custom redeclarationsDevin Coughlin2016-10-161-0/+4
| | | | | | | | | | | | | Add additional checking to MallocChecker to avoid crashing when memory routines have unexpected numbers of arguments. You wouldn't expect to see much of this in normal code (-Wincompatible-library-redeclaration warns on this), but, for example, CMake tests can generate these. This is PR30616. rdar://problem/28631974 llvm-svn: 284335
* Revert "[analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker""Devin Coughlin2016-10-161-35/+3
| | | | | | | | | | | | Revert: r283662: [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker" r283660: [analyzer] Fix build error after r283660 - remove constexpr strings. It was causing an internal build bot to fail. It looks like in some cases adding an extra note can cause scan-build plist output to drop a diagnostic altogether. llvm-svn: 284317
* [analyzer] Link libStaticAnalyzerCheckers to libASTMatchers.Artem Dergachev2016-10-131-0/+1
| | | | | | | | | | | | | AST matchers are useful for the analyzer's checkers. More patches on particular checkers shall follow. This is the first time clang binary gets linked to ASTMatchers. The binary size increase for the clang executable would be +0.5% in release mode, +2% in debug mode. Differential Revision: https://reviews.llvm.org/D25429 llvm-svn: 284112
* [analyzer] DeallocChecker: Don't warn about directly-set IBOutlet ivars on macOSDevin Coughlin2016-10-121-0/+31
| | | | | | | | | | | | | | | | On macOS (but not iOS), if an ObjC property has no setter, the nib-loading code for an IBOutlet is documented as directly setting the backing ivar without retaining the value -- even if the property is 'retain'. This resulted in false positives from the DeallocChecker for code that did not release such ivars in -dealloc. To avoid these false positives, treat IBOutlet ivars that back a property without a setter as having an unknown release requirement in macOS. rdar://problem/28507353 llvm-svn: 284084
* [analyzer] Fix build error after r283660 - remove constexpr strings.Artem Dergachev2016-10-081-2/+8
| | | | llvm-svn: 283662
* [analyzer] Re-apply r283094 "Improve CloneChecker diagnostics"Artem Dergachev2016-10-081-50/+56
| | | | | | The parent commit (r283092) was reverted before and now finally landed. llvm-svn: 283661
* [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker"Artem Dergachev2016-10-081-3/+29
| | | | | | The parent commit (r283092) was reverted before and now finally landed. llvm-svn: 283660
* [analyzer] Add PostStmt callback for ArraySubscriptExprAnna Zaks2016-10-041-1/+13
| | | | | | | | A patch by Jan Smets! Differential Revision: https://reviews.llvm.org/D25009 llvm-svn: 283253
* Revert "[analyzer] Improve CloneChecker diagnostics" as its depends on ↵Vitaly Buka2016-10-041-56/+50
| | | | | | | | reverted r283092 This reverts commit r283094. llvm-svn: 283182
* Revert "[analyzer] Add extra notes to ObjCDeallocChecker" as its depends on ↵Vitaly Buka2016-10-041-29/+3
| | | | | | | | reverted r283092 This reverts commit r283093. llvm-svn: 283181
* [analyzer] Improve CloneChecker diagnosticsArtem Dergachev2016-10-031-50/+56
| | | | | | | | | | | | | | | | | | Highlight code clones referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Change warning text to more clang-ish. Remove suggestions from the copy-paste error checker diagnostics, because currently our suggestions are strictly 50% wrong (we do not know which of the two code clones contains the error), and for that reason we should not sound as if we're actually suggesting this. Hopefully a better solution would bring them back. Make sure the suspicious clone pair structure always mentions the correct variable for the second clone. Differential Revision: https://reviews.llvm.org/D24916 llvm-svn: 283094
* [analyzer] Add extra notes to ObjCDeallocCheckerArtem Dergachev2016-10-031-3/+29
| | | | | | | | | | The report is now highlighting instance variables and properties referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Differential Revision: https://reviews.llvm.org/D24915 llvm-svn: 283093
* [StaticAnalyzer] Fix false positives for vardecls that are technically ↵Daniel Marjamaki2016-09-281-2/+4
| | | | | | | | | | | | | | | unreachable but they are needed. Example: switch (x) { int a; // <- This is unreachable but needed case 1: a = ... Differential Revision: https://reviews.llvm.org/D24905 llvm-svn: 282574
* [analyzer] Improve CastToStruct checker so it can also detect widening casts ↵Daniel Marjamaki2016-09-261-22/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | of struct data Example: struct AB { int A; int B; }; struct ABC { int A; int B; int C; }; void f() { struct AB Data; struct ABC *P = (struct ABC *)&Data; } Differential Revision: https://reviews.llvm.org/D23508 llvm-svn: 282411
* [analyzer] Fix crash in RetainCountChecker::checkEndFunctionAlexander Shaposhnikov2016-09-231-1/+1
| | | | | | | | | | | | | | | | | The class BodyFarm creates bodies for OSAtomicCompareAndSwap*, objc_atomicCompareAndSwap*, dispatch_sync*, dispatch_once* and for them the flag isBodyAutosynthesized is set to true. This diff 1. makes AnalysisConsumer::HandleCode skip the autosynthesized code 2. replaces assert(LCtx->getParent()) in RetainCountChecker::checkEndFunction by assert(!LCtx->inTopFrame()) (minor cleanup) Test plan: make -j8 check-clang-analysis Differential revision: https://reviews.llvm.org/D24792 llvm-svn: 282293
* [analyzer] Add a checker that detects blocks in critical sectionsAnna Zaks2016-09-202-0/+110
| | | | | | | | | | | | | | | | | | | | | | | | | This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock. Example: mutex_t m; void f() { sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked] // do some work } void foobar() { lock(m); f(); unlock(m); } A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D21506 llvm-svn: 282011
* [analyzer] Calculate extent size for memory regions allocated by new expression.Gabor Horvath2016-09-192-12/+57
| | | | | | | | | | | ArrayBoundChecker did not detect out of bounds memory access errors in case an array was allocated by the new expression. This patch resolves this issue. Patch by Daniel Krupp! Differential Revision: https://reviews.llvm.org/D24307 llvm-svn: 281934
* ObjectiveC Generics: Start using ObjCTypeParamType.Manman Ren2016-09-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | For ObjC type parameter, we used to have TypedefType that is canonicalized to id or the bound type. We can't represent "T <protocol>" and thus will lose the type information in the following example: @interface MyMutableDictionary<KeyType, ObjectType> : NSObject - (void)setObject:(ObjectType)obj forKeyedSubscript:(KeyType <NSCopying>)key; @end MyMutableDictionary<NSString *, NSString *> *stringsByString; NSNumber *n1, *n2; stringsByString[n1] = n2; --> no warning on type mismatch of the key. To fix the problem, we introduce a new type ObjCTypeParamType that supports a list of protocol qualifiers. We create ObjCTypeParamType for ObjCTypeParamDecl when we create ObjCTypeParamDecl. We also substitute ObjCTypeParamType instead of TypedefType on an ObjCTypeParamDecl. rdar://24619481 rdar://25060179 Differential Revision: http://reviews.llvm.org/D23080 llvm-svn: 281358
* [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>Aleksei Sidorin2016-09-012-0/+57
| | | | | | | | | This patch also introduces AnalysisOrderChecker which is intended for testing of callback call correctness. Differential Revision: https://reviews.llvm.org/D23804 llvm-svn: 280367
* [analyzer] Use lazily created buffer in EmptyLocalizationContextCheckerDevin Coughlin2016-08-301-1/+8
| | | | | | | | | | | Fix a crash when relexing the underlying memory buffer to find incorrect arguments to NSLocalizedString(). With precompiled headers, the raw buffer may be NULL. Instead, use the source manager to get the buffer, which will lazily create the buffer for precompiled headers. rdar://problem/27429091 llvm-svn: 280174
* Reapply "[analyzer] Added valist related checkers."Gabor Horvath2016-08-222-0/+374
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279427
* [analyzer] Correctly add assumptions based on array bounds.Gabor Horvath2016-08-221-12/+67
| | | | | | | | Also simplify the constraints generated by the checker. Differential Revision: https://reviews.llvm.org/D23112 llvm-svn: 279425
* [analyzer] Use faster hashing (MD5) in CloneDetector.Artem Dergachev2016-08-201-9/+0
| | | | | | | | | | | | | | | This replaces the old approach of fingerprinting every AST node into a string, which avoided collisions and was simple to implement, but turned out to be extremely ineffective with respect to both performance and memory. The collisions are now dealt with in a separate pass, which no longer causes performance problems because collisions are rare. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22515 llvm-svn: 279378
* [analyzer] Teach CloneDetector to find clones that look like copy-paste errors.Artem Dergachev2016-08-181-2/+70
| | | | | | | | | | | | | | | | | | | The original clone checker tries to find copy-pasted code that is exactly identical to the original code, up to minor details. As an example, if the copy-pasted code has all references to variable 'a' replaced with references to variable 'b', it is still considered to be an exact clone. The new check finds copy-pasted code in which exactly one variable seems out of place compared to the original code, which likely indicates a copy-paste error (a variable was forgotten to be renamed in one place). Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23314 llvm-svn: 279056
* revert [analyzer] Added valist related checkers.Gabor Horvath2016-08-182-374/+0
| | | | llvm-svn: 279043
* [analyzer] Added valist related checkers.Gabor Horvath2016-08-182-0/+374
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279041
* [analyzer] Small cleanups when checkers retrieving statements from explodedGabor Horvath2016-08-186-50/+9
| | | | | | | | nodes. Differential Revision: https://reviews.llvm.org/D23550 llvm-svn: 279037
* [analyzer] Add a checker for loss of sign or precision in integral casts.Artem Dergachev2016-08-172-0/+193
| | | | | | | | | | | | | | | This new checker tries to find execution paths on which implicit integral casts cause definite loss of information: a certainly-negative integer is converted to an unsigned integer, or an integer is definitely truncated to fit into a smaller type. Being implicit, such casts are likely to produce unexpected results. Patch by Daniel Marjamäki! Differential Revision: https://reviews.llvm.org/D13126 llvm-svn: 278941
* [analyzer] Add LocationContext information to SymbolMetadata.Artem Dergachev2016-08-171-0/+1
| | | | | | | | | | | | | | | | | | | | | Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 llvm-svn: 278937
* StaticAnalyzer: Report found fields order in PaddingCheckerSaleem Abdulrasool2016-08-151-22/+36
| | | | | | | | Report the found fields order in PaddingChecker. Patch by Alexander Shaposhnikov! llvm-svn: 278730
* Revert test commitAlexander Droste2016-08-121-1/+0
| | | | llvm-svn: 278534
* Test commit - first LLVM repo commitAlexander Droste2016-08-121-0/+1
| | | | llvm-svn: 278533
* [analyzer] Teach RetainCountChecker about CVFooRetainDevin Coughlin2016-08-111-4/+6
| | | | | | | | | | | | Change the retain count checker to treat CoreFoundation-style "CV"-prefixed reference types from CoreVideo similarly to CoreGraphics types. With this change, we treat CVFooRetain() on a CVFooRef type as a retain. CVFooRelease() APIs are annotated as consuming their parameter, so this change prevents false positives about incorrect decrements of reference counts. <rdar://problem/27116090> llvm-svn: 278382
* [analyzer] Update two comments in MPI-Checker. NFC.Devin Coughlin2016-08-022-7/+4
| | | | | | | | | | Correct two comments that do not match the current behavior of the checker. A patch by Alexander Droste! Differential Revision: https://reviews.llvm.org/D22670 llvm-svn: 277547
* [analyzer] Update APIs taking user-facing strings.Devin Coughlin2016-07-301-6/+22
| | | | | | | | | | | Add new APIs that require localized strings and remove two APIs that were incorrectly marked as requiring a user-facing string. A patch by Kulpreet Chilana! Differential Revision: https://reviews.llvm.org/D22926 llvm-svn: 277273
* [analyzer] Fix misleading indentation in ObjCDeallocChecker. NFC.Devin Coughlin2016-07-281-1/+1
| | | | llvm-svn: 277009
* [analyzer] Add check::BeginFunction to CheckerDocumentation checks. NFC.Devin Coughlin2016-07-281-0/+1
| | | | | | This was an oversight from when I added BeginFunction support in r261293. llvm-svn: 276950
* [analyzer] Hotfix for build failure due to declaration shadowing in r276782.Artem Dergachev2016-07-261-3/+3
| | | | | | | CloneDetector member variable is shadowing the class with the same name, which causes build failures on some platforms. llvm-svn: 276791
* [analyzer] Add basic capabilities to detect source code clones.Artem Dergachev2016-07-262-0/+97
| | | | | | | | | | | | | | | | | | | | | This patch adds the CloneDetector class which allows searching source code for clones. For every statement or group of statements within a compound statement, CloneDetector computes a hash value, and finds clones by detecting identical hash values. This initial patch only provides a simple hashing mechanism that hashes the kind of each sub-statement. This patch also adds CloneChecker - a simple static analyzer checker that uses CloneDetector to report copy-pasted code. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D20795 llvm-svn: 276782
* MPI-Checker: move MPIFunctionClassifier.hAlexander Kornienko2016-07-255-106/+10
| | | | | | | | | | | | | | | | Summary: This patch moves the MPIFunctionClassifier header to `clang/include/clang/StaticAnalyzer/Checkers`, in order to make it accessible in other parts of the architecture. Reviewers: dcoughlin, zaks.anna Subscribers: alexfh, cfe-commits Patch by Alexander Droste! Differential Revision: https://reviews.llvm.org/D22671 llvm-svn: 276639
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-212-0/+63
| | | | | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). This reapplies r275820 after fixing a string-lifetime issue discovered by the bots. A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 276365
* [NFC] Header cleanupMehdi Amini2016-07-187-10/+3
| | | | | | | | | | Summary: Removed unused headers, replaced some headers with forward class declarations Patch by: Eugene <claprix@yandex.ru> Differential Revision: https://reviews.llvm.org/D20100 llvm-svn: 275882
* Revert "[analyzer] Add checker modeling potential C++ self-assignment"Devin Coughlin2016-07-182-63/+0
| | | | | | This reverts commit r275820. It is failing on the bots. llvm-svn: 275880
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-182-0/+63
| | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 275820
* [analyzer] Implement a methond to discover origin region of a symbol.Artem Dergachev2016-07-132-18/+2
| | | | | | | | | | | | | This encourages checkers to make logical decisions depending on value of which region was the symbol under consideration introduced to denote. A similar technique is already used in a couple of checkers; they were modified to call the new method. Differential Revision: http://reviews.llvm.org/D22242 llvm-svn: 275290
OpenPOWER on IntegriCloud