summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Improve pointer arithmetic checker.Gabor Horvath2016-02-231-25/+299
| | | | | | | | | | | This patch is intended to improve pointer arithmetic checker. From now on it only warns when the pointer arithmetic is likely to cause an error. For example when the pointer points to a single object, or an array of derived types. Differential Revision: http://reviews.llvm.org/D14203 llvm-svn: 261632
* [analyzer] Detect duplicate [super dealloc] callsDevin Coughlin2016-02-223-0/+202
| | | | | | | | | | | | | | Add an alpha path checker that warns about duplicate calls to [super dealloc]. This will form the foundation of a checker that will detect uses of 'self' after calling [super dealloc]. Part of rdar://problem/6953275. Based on a patch by David Kilzer! Differential Revision: http://reviews.llvm.org/D5238 llvm-svn: 261545
* [analyzer] Add checker callback for beginning of function.Devin Coughlin2016-02-192-1/+15
| | | | | | | | | | Add a checker callback that is called when the analyzer starts analyzing a function either at the top level or when inlined. This will be used by a follow-on patch making the DeallocChecker path sensitive. Differential Revision: http://reviews.llvm.org/D17418 llvm-svn: 261293
* Simplify users of StringRef::{l,r}trim (clang) (NFC)Vedant Kumar2016-02-162-2/+2
| | | | | | | r260925 introduced a version of the *trim methods which is preferable when trimming a single kind of character. Update all users in clang. llvm-svn: 260927
* [analyzer] Improve pattern matching in ObjCDealloc checker.Devin Coughlin2016-02-111-8/+17
| | | | | | | | Look through PseudoObjectExpr and OpaqueValueExprs when scanning for release-like operations. This commit also adds additional tests in anticipation of re-writing this as a path-sensitive checker. llvm-svn: 260608
* Fix some Clang-tidy readability-redundant-control-flow warnings; other minor ↵Eugene Zelenko2016-02-107-40/+19
| | | | | | | | fixes. Differential revision: http://reviews.llvm.org/D17060 llvm-svn: 260414
* [analyzer] Invalidate destination of std::copy() and std::copy_backward().Devin Coughlin2016-02-071-0/+58
| | | | | | | | | Now that the libcpp implementations of these methods has a branch that doesn't call memmove(), the analyzer needs to invalidate the destination for these methods explicitly. rdar://problem/23575656 llvm-svn: 260043
* [analyzer] DeallocChecker: Don't warn on release of readonly assign property ↵Devin Coughlin2016-02-061-0/+6
| | | | | | | | | in dealloc. It is common for the ivars for read-only assign properties to always be stored retained, so don't warn for a release in dealloc for the ivar backing these properties. llvm-svn: 259998
* [analyzer] Suppress localization diagnostics in debug classes and methods.Devin Coughlin2016-02-051-0/+35
| | | | | | | If the class or method name case-insensitively contains the term "debug", suppress warnings about string constants flowing to user-facing UI APIs. llvm-svn: 259875
* Avoid overly large SmallPtrSet/SmallSetMatthias Braun2016-01-302-6/+2
| | | | | | | | | These sets perform linear searching in small mode so it is never a good idea to use SmallSize/N bigger than 32. Differential Revision: http://reviews.llvm.org/D16705 llvm-svn: 259284
* Annotate dump() methods with LLVM_DUMP_METHOD, addressing Richard Smith ↵Yaron Keren2016-01-291-1/+1
| | | | | | r259192 post commit comment. llvm-svn: 259232
* [analyzer] Improve Nullability checker diagnosticsAnna Zaks2016-01-292-34/+62
| | | | | | | | | - Include the position of the argument on which the nullability is violated - Differentiate between a 'method' and a 'function' in the message wording - Test for the error message text in the tests - Fix a bug with setting 'IsDirectDereference' which resulted in regular dereferences assumed to have call context. llvm-svn: 259221
* Class Property: change PropertyMap to include isClassProperty.Manman Ren2016-01-281-0/+2
| | | | | | | | | | | | | | PropertyMap used to map IdentifierInfo (name of the property) to ObjcPropertyDecl *. Now that a class property can have the same name as an instance property, we change PropertyMap to map a pair <IdentifierInfo *, unsigned> to ObjcPropertyDecl *. Also update a few places from iterating over instance_properties to iterating over all properties. rdar://23891898 llvm-svn: 259119
* [analyzer] NullabilityChecker: Remove unused isReturnSelf() function.Devin Coughlin2016-01-281-16/+0
| | | | | | | Remove the now-unused isReturnSelf() function so we don't get a compiler warning. Apologies for not doing this in r259099. llvm-svn: 259118
* [analyzer] Suppress nullability warnings in copy, mutableCopy, and init ↵Devin Coughlin2016-01-281-11/+10
| | | | | | | | | | | | | | families. There are multiple, common idioms of defensive nil-checks in copy, mutableCopy, and init methods in ObjC. The analyzer doesn't currently have the capability to distinguish these idioms from true positives, so suppress all warnings about returns in those families. This is a pretty blunt suppression that we should improve later. rdar://problem/24395811 llvm-svn: 259099
* [analyzer] ObjCDeallocChecker: Only operate on classes with retained properties.Devin Coughlin2016-01-271-50/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously the ObjC Dealloc Checker only checked classes with ivars, not retained properties, which caused three bugs: - False positive warnings about a missing -dealloc method in classes with only ivars. - Missing warnings about a missing -dealloc method on classes with only properties. - Missing warnings about an over-released or under-released ivar associated with a retained property in classes with only properties. The fix is to check only classes with at least one retained synthesized property. This also exposed a bug when reporting an over-released or under-released property that did not contain a synthesize statement. The checker tried to associate the warning with an @synthesize statement that did not exist, which caused an assertion failure in debug builds. The fix is to fall back to the @property statement in this case. A patch by David Kilzer! Part of rdar://problem/6927496 Differential Revision: http://reviews.llvm.org/D5023 llvm-svn: 258896
* Remove autoconf supportChris Bieneman2016-01-261-24/+0
| | | | | | | | | | | | | | | | | Summary: This patch is provided in preparation for removing autoconf on 1/26. The proposal to remove autoconf on 1/26 was discussed on the llvm-dev thread here: http://lists.llvm.org/pipermail/llvm-dev/2016-January/093875.html "This is the way [autoconf] ends Not with a bang but a whimper." -T.S. Eliot Reviewers: chandlerc, grosbach, bob.wilson, echristo Subscribers: klimek, cfe-commits Differential Revision: http://reviews.llvm.org/D16472 llvm-svn: 258862
* Fix Clang-tidy modernize-use-nullptr warnings; other minor fixes.Eugene Zelenko2016-01-261-3/+3
| | | | | | Differential revision: http://reviews.llvm.org/D16567 llvm-svn: 258836
* Use instance_properties instead of properties. NFC.Manman Ren2016-01-261-1/+1
| | | | | | | | | | | All current properties are instance properties. This is the second patch in a series of patches to support class properties in addition to instance properties in objective-c. rdar://23891898 llvm-svn: 258824
* [analyzer] Utility to match function calls.Gabor Horvath2016-01-221-21/+4
| | | | | | | | This patch adds a small utility to match function calls. This utility abstracts away the mutable keywords and the lazy initialization and caching logic of identifiers from the checkers. The SimpleStreamChecker is ported over this utility within this patch to show the reduction of code and to test this change. Differential Revision: http://reviews.llvm.org/D15921 llvm-svn: 258572
* [analyzer] Suppress nullability warning for defensive super initializer idiom.Devin Coughlin2016-01-221-4/+33
| | | | | | | | | | | | | | | A common idiom in Objective-C initializers is for a defensive nil-check on the result of a call to a super initializer: if (self = [super init]) { ... } return self; To avoid warning on this idiom, the nullability checker now suppress diagnostics for returns of nil on syntactic 'return self' even in initializers with non-null return types. llvm-svn: 258461
* [analyzer] Nullability: Look through implicit casts when suppressing ↵Devin Coughlin2016-01-181-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | warnings on return. In r256567 I changed the nullability checker to suppress warnings about returning a null value from a function/method with a non-null return type when the type of the returned expression is itself nonnull. This enables the programmer to silence nullability warnings by casting to _Nonnull: return (SomeObject * _Nonnull)nil; Unfortunately, under ObjC automated reference counting, Sema adds implicit casts to _Nonnull to return expressions of nullable or unspecified types in functions with non-null function/method return types. With r256567, these casts cause all nullability warnings for returns of reference-counted types to be suppressed under ARC, leading to false negatives. This commit updates the nullability checker to look through implicit casts before determining the type of the returned expression. It also updates the tests to turn on ARC for the nullability_nullonly.mm testfile and adds a new testfile to test when ARC is turned off. rdar://problem/24200117 llvm-svn: 258061
* [analyzer] Check for return of nil in ObjC methods with nonnull return type.Devin Coughlin2016-01-151-20/+20
| | | | | | | | | | | | Update NullabilityChecker so that it checks return statements in ObjC methods. Previously it was returning early because methods do not have a function type. Also update detection of violated parameter _Nonnull preconditions to handle ObjC methods. rdar://problem/24200560 llvm-svn: 257938
* [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion, v2.Artem Dergachev2016-01-151-34/+51
| | | | | | | | | | | | | | | | Provide separate visitor templates for the three hierarchies, and also the `FullSValVisitor' class, which is a union of all three visitors. Additionally, add a particular example visitor, `SValExplainer', in order to test the visitor templates. This visitor is capable of explaining the SVal, SymExpr, or MemRegion in a natural language. Compared to the reverted r257605, this fixes the test that used to fail on some triples, and fixes build failure under -fmodules. Differential Revision: http://reviews.llvm.org/D15448 llvm-svn: 257893
* Update for LLVM function name change.Rui Ueyama2016-01-141-2/+2
| | | | llvm-svn: 257802
* Revert "[analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion."Artem Dergachev2016-01-131-51/+34
| | | | | | | | | This reverts commit r257605. The test fails on architectures that use unsigned int as size_t. SymbolManager.h fails with compile errors on some platforms. llvm-svn: 257608
* [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion.Artem Dergachev2016-01-131-34/+51
| | | | | | | | | | | | | Provide separate visitor templates for the three hierarchies, and also the `FullSValVisitor' class, which is a union of all three visitors. Additionally, add a particular example visitor, `SValExplainer', in order to test the visitor templates. This visitor is capable of explaining the SVal, SymExpr, or MemRegion in a natural language. Differential Revision: http://reviews.llvm.org/D15448 llvm-svn: 257605
* [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.Artem Dergachev2016-01-132-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of these changes is to simplify introduction of definition files for the three hierarchies. 1. For every sub-class C of these classes, its kind in the relevant enumeration is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg: MemRegionKind -> MemRegionValKind RegionValueKind -> SymbolRegionValueKind CastSymbolKind -> SymbolCastKind SymIntKind -> SymIntExprKind 2. MemSpaceRegion used to be inconsistently used as both an abstract base and a particular region. This region class is now an abstract base and no longer occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion, is introduced for handling the unique use case for MemSpaceRegion as "the generic memory space" (when it represents a memory space that holds all executable code). 3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for consisitency with symbol kind ranges. 4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and we already refer to BlockTextRegion as a 'code region' in BlockDataRegion. Differential Revision: http://reviews.llvm.org/D16062 llvm-svn: 257598
* [analyzer] Fix false warning about memory leak for QApplication::postEventAnna Zaks2016-01-061-0/+10
| | | | | | | | | | | According to Qt documentation Qt takes care of memory allocated for QEvent: http://doc.qt.io/qt-4.8/qcoreapplication.html#postEvent A patch by Evgeniy Dushistov! Differential Revision: http://reviews.llvm.org/D14170 llvm-svn: 256887
* [analyzer] Don't report null dereferences on address_space annotated memoryAnna Zaks2016-01-061-20/+35
| | | | llvm-svn: 256885
* [analyzer] Handle another Android assert function.Devin Coughlin2015-12-301-0/+1
| | | | | | | | | | | Android's assert can call both the __assert and __assert2 functions under the cover, but the NoReturnFunctionChecker does not handle the latter. This commit fixes that. A patch by Yury Gribov! Differential Revision: http://reviews.llvm.org/D15810 llvm-svn: 256605
* [analyzer] Suppress nullability warning for _Nonnull locals zero-initialized ↵Devin Coughlin2015-12-291-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | by ObjC ARC. Prevent the analyzer from warning when a _Nonnnull local variable is implicitly zero-initialized because of Objective-C automated reference counting. This avoids false positives in cases where a _Nonnull local variable cannot be initialized with an initialization expression, such as: NSString * _Nonnull s; // no-warning @autoreleasepool { s = ...; } The nullability checker will still warn when a _Nonnull local variable is explicitly initialized with nil. This suppression introduces the potential for false negatives if the local variable is used before it is assigned a _Nonnull value. Based on a discussion with Anna Zaks, Jordan Rose, and John McCall, I've added a FIXME to treat implicitly zero-initialized _Nonnull locals as uninitialized in Sema's UninitializedValues analysis to avoid these false negatives. rdar://problem/23522311 llvm-svn: 256603
* [analyzer] Nullability: allow cast to _Nonnull to suppress warning about ↵Devin Coughlin2015-12-291-12/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | returning nil. The nullability checker currently allows casts to suppress warnings when a nil literal is passed as an argument to a parameter annotated as _Nonnull: foo((NSString * _Nonnull)nil); // no-warning It does so by suppressing the diagnostic when the *type* of the argument expression is _Nonnull -- even when the symbolic value returned is known to be nil. This commit updates the nullability checker to similarly honor such casts in the analogous scenario when nil is returned from a function with a _Nonnull return type: return (NSString * _Nonnull)nil; // no-warning This commit also normalizes variable naming between the parameter and return cases and adds several tests demonstrating the limitations of this suppression mechanism (such as when nil is cast to _Nonnull and then stored into a local variable without a nullability qualifier). These tests are marked with FIXMEs. rdar://problem/23176782 llvm-svn: 256567
* Refactor: Simplify boolean conditional return statements in ↵Alexander Kornienko2015-12-2811-70/+29
| | | | | | | | | | | | | | | | lib/StaticAnalyzer/Checkers Summary: Use clang-tidy to simplify boolean conditional return values Reviewers: dcoughlin, krememek Subscribers: krememek, cfe-commits Patch by Richard Thomson! Differential Revision: http://reviews.llvm.org/D10021 llvm-svn: 256491
* [PATCH] Adding checker to detect excess padding in recordsBen Craig2015-12-143-0/+329
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this checker is to generate a report for any class / structure that could reduce its padding by reordering the fields. This results in a very noisy checker. To reduce the noise, this checker will currently only warn when the number of bytes over "optimal" is more than 24. This value is configurable with -analyzer-config performance.Padding:AllowedPad=N. Small values of AllowedPad have the potential to generate hundreds of reports, and gigabytes of HTML reports. The checker searches for padding violations in two main ways. First, it goes record by record. A report is generated if the fields could be reordered in a way that reduces the padding by more than AllowedPad bytes. Second, the checker will generate a report if an array will cause more than AllowedPad padding bytes to be generated. The record checker currently skips many ABI specific cases. Classes with base classes are skipped because base class tail padding is ABI specific. Bitfields are just plain hard, and duplicating that code seems like a bad idea. VLAs are both uncommon and non-trivial to fix. The array checker isn't very thorough right now. It only checks to see if the element type's fields could be reordered, and it doesn't recursively check to see if any of the fields' fields could be reordered. At some point in the future, it would be nice if "arrays" could also look at array new usages and malloc patterns that appear to be creating arrays. llvm-svn: 255545
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-101-2/+44
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* [analyzer] Suppress stack address escape on CK_CopyAndAutoreleaseBlockObject.Devin Coughlin2015-12-031-0/+9
| | | | | | | | | | Don't warn about addresses of stack-allocated blocks escaping if the block region was cast with CK_CopyAndAutoreleaseBlockObject. These casts, which are introduced in the implicit conversion operator for lambda-to-block conversions, cause the block to be copied to the heap -- so the warning is spurious. llvm-svn: 254639
* [analyzer] Fix IssueHash generation.Gabor Horvath2015-12-011-1/+2
| | | | | | | | Differential Revision: http://reviews.llvm.org/D14919 Original patch by: Gyorgy Orban! llvm-svn: 254394
* Test commitPierre Gousseau2015-11-261-2/+1
| | | | | | Remove tabs. llvm-svn: 254181
* [analyzer] Pass value expression for inlined defensive checks when binding ↵Devin Coughlin2015-11-241-1/+30
| | | | | | | | | | | | | | | | null to nonnull. The nullability checker was not suppressing false positives resulting from inlined defensive checks when null was bound to a nonnull variable because it was passing the entire bind statement rather than the value expression to trackNullOrUndefValue(). This commit changes that checker to synactically match on the bind statement to extract the value expression so it can be passed to trackNullOrUndefValue(). rdar://problem/23575439 llvm-svn: 254007
* [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ ↵Devin Coughlin2015-11-201-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | lambdas as escaped. The analyzer currently reports dead store false positives when a local variable is captured by reference in a C++ lambda. For example: int local = 0; auto lambda = [&local]() { local++; }; local = 7; // False Positive: Value stored to 'local' is never read lambda(); In this case, the assignment setting `local` to 7 is not a dead store because the called lambda will later read that assigned value. This commit silences this source of false positives by treating locals captured by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker deals with locals whose address is taken. rdar://problem/22165179 llvm-svn: 253630
* [static analyzer] Don't flag nil storage into NSMutableDictionary.Anna Zaks2015-11-111-2/+1
| | | | | | This is now allowed and has the behavior of removing the mapping. llvm-svn: 252679
* [analyzer] Add VforkChecker to find unsafe code in vforked process.Yury Gribov2015-11-064-9/+229
| | | | | | | | | | | | This checker looks for unsafe constructs in vforked process: function calls (excluding whitelist), memory write and returns. This was originally motivated by a vfork-related bug in xtables package. Patch by Yury Gribov. Differential revision: http://reviews.llvm.org/D14014 llvm-svn: 252285
* Fix some Clang-tidy modernize warnings, other minor fixes.Eugene Zelenko2015-11-041-3/+3
| | | | | | Differential revision: http://reviews.llvm.org/D14311 llvm-svn: 252081
* [analyzer] Add 'optin' checker package and move localizability checkers into it.Devin Coughlin2015-11-042-13/+44
| | | | | | | | | | | | | | | | | | | | | | This commit creates a new 'optin' top-level checker package and moves several of the localizability checkers into it. This package is for checkers that are not alpha and that would normally be on by default but where the driver does not have enough information to determine when they are applicable. The localizability checkers fit this criterion because the driver cannot determine whether a project is localized or not -- this is best determined at the IDE or build-system level. This new package is *not* intended for checkers that are too noisy to be on by default. The hierarchy under 'optin' mirrors that in 'alpha': checkers under 'optin' should be organized in the hierarchy they would have had if they were truly top level (e.g., optin.osx.cocoa.MyOptInChecker). Differential Revision: http://reviews.llvm.org/D14303 llvm-svn: 252080
* [analyzer] Move the ObjCGenericsChecker out of the alpha package.Devin Coughlin2015-11-031-4/+4
| | | | | | | It is now in the osx.cocoa package and so will be on by default for Apple toolchains. llvm-svn: 251966
* Support watchOS and tvOS driver optionsTim Northover2015-10-301-1/+2
| | | | | | | | This patch should add support for almost all command-line options and driver tinkering necessary to produce a correct "clang -cc1" invocation for watchOS and tvOS. llvm-svn: 251706
* Put global classes into the appropriate namespace.Benjamin Kramer2015-10-281-0/+2
| | | | | | | Most of the cases belong into an anonymous namespace. No functionality change intended. llvm-svn: 251514
* [analyzer] Assume escape is possible through system functions taking void*Anna Zaks2015-10-271-1/+1
| | | | | | | | | | | | | | | | | | The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
* [analyzer] Bug identificationGabor Horvath2015-10-222-0/+39
| | | | | | | | | | | | | | | | This patch adds hashes to the plist and html output to be able to identfy bugs for suppressing false positives or diff results against a baseline. This hash aims to be resilient for code evolution and is usable to identify bugs in two different snapshots of the same software. One missing piece however is a permanent unique identifier of the checker that produces the warning. Once that issue is resolved, the hashes generated are going to change. Until that point this feature is marked experimental, but it is suitable for early adoption. Differential Revision: http://reviews.llvm.org/D10305 Original patch by: Bence Babati! llvm-svn: 251011
OpenPOWER on IntegriCloud