summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [Concepts] Requires ExpressionsSaar Raz2020-01-241-0/+1
| | | | | | | | | | Implement support for C++2a requires-expressions. Re-commit after compilation failure on some platforms due to alignment issues with PointerIntPair. Differential Revision: https://reviews.llvm.org/D50360 (cherry picked from commit a0f50d731639350c7a79f140f026c27a18215531)
* [analyzer] Do not cache out on some shared implicit AST nodesGabor Horvath2019-12-111-1/+5
| | | | | | | | | | | Some AST nodes which stands for implicit initialization is shared. The analyzer will do the same evaluation on the same nodes resulting in the same state. The analyzer will "cache out", i.e. it thinks that it visited an already existing node in the exploded graph. This is not true in this case and we lose coverage. Since these nodes do not really require any processing from the analyzer we just omit them from the CFG. Differential Revision: https://reviews.llvm.org/D71371
* [analyzer] Escape symbols conjured into specific regions during a ↵Gabor Horvath2019-12-111-32/+56
| | | | | | | | | | conservative EvalCall This patch introduced additional PointerEscape callbacks after conservative calls for output parameters. This should not really affect the current checkers but the upcoming FuchsiaHandleChecker relies on this heavily. Differential Revision: https://reviews.llvm.org/D71224
* Revert "[analyzer] Keep track of escaped locals"Gabor Horvath2019-12-101-16/+2
| | | | | | | | | | | | | | | It was a step in the right direction but it is not clear how can this fit into the checker API at this point. The pre-escape happens in the analyzer core and the checker has no control over it. If the checker is not interestd in a pre-escape it would need to do additional work on each escape to check if the escaped symbol is originated from an "uninteresting" pre-escaped memory region. In order to keep the checker API simple we abandoned this solution for now. We will reland this once we have a better answer for what to do on the checker side. This reverts commit f3a28202ef58551db15818f8f51afd21e0f3e231.
* [analyzer] Keep track of escaped localsGabor Horvath2019-12-101-2/+16
| | | | | | | | We want to escape all symbols that are stored into escaped regions. The problem is, we did not know which local regions were escaped. Until now. This should fix some false positives like the one in the tests. Differential Revision: https://reviews.llvm.org/D71152
* [OpenMP50] Add parallel master constructcchen2019-12-051-0/+1
| | | | | | | | | | | | Reviewers: ABataev, jdoerfert Reviewed By: ABataev Subscribers: rnk, jholewinski, guansong, arphaman, jfb, cfe-commits, sandoval, dreachem Tags: #clang Differential Revision: https://reviews.llvm.org/D70726
* Revert "[OpenMP50] Add parallel master construct, by Chi Chun Chen."Reid Kleckner2019-12-041-1/+0
| | | | | | This reverts commit 713dab21e27c987b9114547ce7136bac2e775de9. Tests do not pass on Windows.
* [OpenMP50] Add parallel master construct, by Chi Chun Chen.cchen2019-12-041-0/+1
| | | | | | | | | | | | Reviewers: ABataev, jdoerfert Reviewed By: ABataev Subscribers: jholewinski, guansong, arphaman, jfb, cfe-commits, sandoval, dreachem Tags: #clang Differential Revision: https://reviews.llvm.org/D70726
* [analyzer] NFC: Don't clean up range constraints twice.Artem Dergachev2019-11-211-1/+2
| | | | | | Slightly improves static analysis speed. Differential Revision: https://reviews.llvm.org/D70150
* [NFC] Refactor representation of materialized temporariesTyker2019-11-191-1/+1
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: thakis, sammccall, ilya-biryukov, rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* Revert "[NFC] Refactor representation of materialized temporaries"Nico Weber2019-11-171-1/+1
| | | | | | This reverts commit 08ea1ee2db5f9d6460fef1d79d0d1d1a5eb78982. It broke ./ClangdTests/FindExplicitReferencesTest.All on the bots, see comments on https://reviews.llvm.org/D69360
* [NFC] Refactor representation of materialized temporariesTyker2019-11-161-1/+1
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* [OPENMP50]Add support for parallel master taskloop simd directive.Alexey Bataev2019-10-301-0/+1
| | | | Added full support for parallel master taskloop simd directive.
* [c++20] Add CXXRewrittenBinaryOperator to represent a comparisonRichard Smith2019-10-191-0/+1
| | | | | | | | operator that is rewritten as a call to multiple other operators. No functionality change yet: nothing creates these expressions. llvm-svn: 375305
* [analyzer] Drop the logic for collapsing the state if it's same as in preds.Artem Dergachev2019-10-181-10/+1
| | | | | | | | | | One of the first attempts to reduce the size of the exploded graph dumps was to skip the state dump as long as the state is the same as in all of the predecessor nodes. With all the new facilities in place (node joining, diff dumps), this feature doesn't do much, and when it does, it's more harmful than useful. Let's remove it. llvm-svn: 375280
* [analyzer] Fix hidden node traversal in exploded graph dumps.Artem Dergachev2019-10-181-11/+5
| | | | | | | | | The joined nodes now actually have the same state. That was intended from the start but the original implementation turned out to be buggy. Differential Revision: https://reviews.llvm.org/D69150 llvm-svn: 375278
* [OPENMP50]Add support for master taskloop simd.Alexey Bataev2019-10-181-0/+1
| | | | | | Added trsing/semantics/codegen for combined construct master taskloop simd. llvm-svn: 375255
* [analyzer] Assign truly stable identifiers to exploded nodes.Artem Dergachev2019-10-171-12/+6
| | | | | | | | | | | ExplodedGraph nodes will now have a numeric identifier stored in them which will keep track of the order in which the nodes were created and it will be fully deterministic both accross runs and across machines. This is extremely useful for debugging as it allows reliably setting conditional breakpoints by node IDs. llvm-svn: 375186
* [Concepts] Concept Specialization ExpressionsSaar Raz2019-10-151-0/+1
| | | | | | | | | | Part of C++20 Concepts implementation effort. Added Concept Specialization Expressions that are created when a concept is refe$ D41217 on Phabricator. (recommit after fixing failing Parser test on windows) llvm-svn: 374903
* Revert 374882 "[Concepts] Concept Specialization Expressions"Nico Weber2019-10-151-1/+0
| | | | | | | | | | This reverts commit ec87b003823d63f3342cf648f55a134c1522e612. The test fails on Windows, see e.g. http://lab.llvm.org:8011/builders/clang-x64-windows-msvc/builds/11533/steps/stage%201%20check/logs/stdio Also revert follow-up r374893. llvm-svn: 374899
* [Concepts] Concept Specialization ExpressionsSaar Raz2019-10-151-0/+1
| | | | | | Part of C++20 Concepts implementation effort. Added Concept Specialization Expressions that are created when a concept is referenced with arguments, and tests thereof. llvm-svn: 374882
* [OPENMP50]Add support for 'parallel master taskloop' construct.Alexey Bataev2019-10-141-0/+1
| | | | | | | | | Added parsing/sema/codegen support for 'parallel master taskloop' constructs. Some of the clauses, like 'grainsize', 'num_tasks', 'final' and 'priority' are not supported in full, only constant expressions can be used currently in these clauses. llvm-svn: 374791
* [OPENMP50]Support for 'master taskloop' directive.Alexey Bataev2019-10-101-0/+1
| | | | | | Added full support for master taskloop directive. llvm-svn: 374437
* [analyzer] NFC: Simplify bug report equivalence classes to not be ilists.Artem Dergachev2019-09-091-3/+4
| | | | | | | | Use a vector of unique pointers instead. Differential Revision: https://reviews.llvm.org/D67024 llvm-svn: 371451
* [analyzer] NFC: Introduce sub-classes for path-sensitive and basic reports.Artem Dergachev2019-09-091-5/+12
| | | | | | | | | | | | | Checkers are now required to specify whether they're creating a path-sensitive report or a path-insensitive report by constructing an object of the respective type. This makes BugReporter more independent from the rest of the Static Analyzer because all Analyzer-specific code is now in sub-classes. Differential Revision: https://reviews.llvm.org/D66572 llvm-svn: 371450
* [analyzer] Fix a crash when destroying a non-region.Artem Dergachev2019-08-201-12/+11
| | | | | | | | | Add defensive check that prevents a crash when we try to evaluate a destructor whose this-value is a concrete integer that isn't a null. Differential Revision: https://reviews.llvm.org/D65349 llvm-svn: 369450
* Fix parameter name comments using clang-tidy. NFC.Rui Ueyama2019-07-161-1/+1
| | | | | | | | | | | | | | | | | | | | | This patch applies clang-tidy's bugprone-argument-comment tool to LLVM, clang and lld source trees. Here is how I created this patch: $ git clone https://github.com/llvm/llvm-project.git $ cd llvm-project $ mkdir build $ cd build $ cmake -GNinja -DCMAKE_BUILD_TYPE=Debug \ -DLLVM_ENABLE_PROJECTS='clang;lld;clang-tools-extra' \ -DCMAKE_EXPORT_COMPILE_COMMANDS=On -DLLVM_ENABLE_LLD=On \ -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ../llvm $ ninja $ parallel clang-tidy -checks='-*,bugprone-argument-comment' \ -config='{CheckOptions: [{key: StrictMode, value: 1}]}' -fix \ ::: ../llvm/lib/**/*.{cpp,h} ../clang/lib/**/*.{cpp,h} ../lld/**/*.{cpp,h} llvm-svn: 366177
* [analyzer] exploded-graph-rewriter: Implement bug nodes and sink nodes.Artem Dergachev2019-07-031-17/+10
| | | | | | | | | | | Add a label to nodes that have a bug report attached or on which the analysis was generally interrupted. Fix printing has_report and implement printing is_sink in the graph dumper. Differential Revision: https://reviews.llvm.org/D64110 llvm-svn: 364992
* [C++2a] Add __builtin_bit_cast, used to implement std::bit_castErik Pilkington2019-07-021-0/+1
| | | | | | | | | | | | | | | | | | This commit adds a new builtin, __builtin_bit_cast(T, v), which performs a bit_cast from a value v to a type T. This expression can be evaluated at compile time under specific circumstances. The compile time evaluation currently doesn't support bit-fields, but I'm planning on fixing this in a follow up (some of the logic for figuring this out is in CodeGen). I'm also planning follow-ups for supporting some more esoteric types that the constexpr evaluator supports, as well as extending __builtin_memcpy constexpr evaluation to use the same infrastructure. rdar://44987528 Differential revision: https://reviews.llvm.org/D62825 llvm-svn: 364954
* [analyzer] Add more timers for performance profiling.Artem Dergachev2019-06-251-4/+0
| | | | | | | | | | | | | The -analyzer-stats flag now allows you to find out how much time was spent on AST-based analysis and on path-sensitive analysis and, separately, on bug visitors, as they're occasionally a performance problem on their own. The total timer wasn't useful because there's anyway a total time printed out. Remove it. Differential Revision: https://reviews.llvm.org/D63227 llvm-svn: 364266
* [analyzer] Fix JSON dumps for ExplodedNodesCsaba Dabis2019-06-241-6/+2
| | | | | | | | | | | | | | | | | | | Summary: - Now we could see the `has_report` property in `trim-egraph` mode. - This patch also removes the trailing comma after each node. Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63436 llvm-svn: 364193
* [analyzer] Fix JSON dumps for location contexts.Artem Dergachev2019-06-191-3/+0
| | | | | | | | | | | Location context ID is a property of the location context, not of an item within it. It's useful to know the id even when there are no items in the context, eg. for the purposes of figuring out how did contents of the Environment for the same location context changed across states. Differential Revision: https://reviews.llvm.org/D62754 llvm-svn: 363895
* [analyzer] print() JSONify: ExplodedNode revisionCsaba Dabis2019-05-311-3/+3
| | | | | | | | | | | | | | | Summary: Revert node-ID removal. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D62658 llvm-svn: 362249
* [analyzer] Remove EndPath function as it is dead codeCsaba Dabis2019-05-291-1/+0
| | | | | | | | | | | | | | | | | Summary: - Reviewers: george.karpenkov Reviewed By: george.karpenkov Subscribers: baloghadamsoftware, cfe-commits, xazax.hun, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D53720 llvm-svn: 362030
* [analyzer][AST] print() JSONify: Stmt implementationCsaba Dabis2019-05-291-11/+1
| | | | | | | | | | | | | | | | | | | | Summary: This patch also adds a function called `JsonFormat()` which: - Flattens the string so removes the new-lines. - Escapes double quotes. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: cfe-commits, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62494 llvm-svn: 362000
* [analyzer] print() JSONify: getNodeLabel implementationCsaba Dabis2019-05-291-19/+37
| | | | | | | | | | | | | | | | | Summary: This patch also rewrites the ProgramPoint printing. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: cfe-commits, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62346 llvm-svn: 361997
* [analyzer] print() JSONify: Checker messages implementationCsaba Dabis2019-05-291-1/+2
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62086 llvm-svn: 361982
* [analyzer] print() JSONify: Constructing objects implementationCsaba Dabis2019-05-291-32/+95
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62085 llvm-svn: 361980
* [analyzer] print() JSONify: Environment implementationCsaba Dabis2019-05-291-5/+5
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62081 llvm-svn: 361976
* [CFG] NFC: Remove implicit conversion from CFGTerminator to Stmt *.Artem Dergachev2019-05-241-4/+4
| | | | | | | | | | | Turn it into a variant class instead. This conversion does indeed save some code but there's a plan to add support for more kinds of terminators that aren't necessarily based on statements, and with those in mind it becomes more and more confusing to have CFGTerminators implicitly convertible to a Stmt *. Differential Revision: https://reviews.llvm.org/D61814 llvm-svn: 361586
* Implement __builtin_LINE() et. al. to support source location capture.Eric Fiselier2019-05-161-0/+1
| | | | | | | | | | | | | | | | | Summary: This patch implements the source location builtins `__builtin_LINE(), `__builtin_FUNCTION()`, `__builtin_FILE()` and `__builtin_COLUMN()`. These builtins are needed to implement [`std::experimental::source_location`](https://rawgit.com/cplusplus/fundamentals-ts/v2/main.html#reflection.src_loc.creation). With the exception of `__builtin_COLUMN`, GCC also implements these builtins, and Clangs behavior is intended to match as closely as possible. Reviewers: rsmith, joerg, aaron.ballman, bogner, majnemer, shafik, martong Reviewed By: rsmith Subscribers: rnkovacs, loskutov, riccibruno, mgorny, kunitoki, alexr, majnemer, hfinkel, cfe-commits Differential Revision: https://reviews.llvm.org/D37035 llvm-svn: 360937
* Reapply "[analyzer] Introduce a simplified API for adding custom path notes."Artem Dergachev2019-04-191-1/+3
| | | | | | | | This reapplies commit r357323, fixing memory leak found by LSan. Differential Revision: https://reviews.llvm.org/D58367 llvm-svn: 358781
* [analyzer] Escape pointers stored into top-level parameters with destructors.Artem Dergachev2019-04-131-34/+30
| | | | | | | | | | | | | | | | | | | | | | Writing stuff into an argument variable is usually equivalent to writing stuff to a local variable: it will have no effect outside of the function. There's an important exception from this rule: if the argument variable has a non-trivial destructor, the destructor would be invoked on the parent stack frame, exposing contents of the otherwise dead argument variable to the caller. If such argument is the last place where a pointer is stored before the function exits and the function is the one we've started our analysis from (i.e., we have no caller context for it), we currently diagnose a leak. This is incorrect because the destructor of the argument still has access to the pointer. The destructor may deallocate the pointer or even pass it further. Treat writes into such argument regions as "escapes" instead, suppressing spurious memory leak reports but not messing with dead symbol removal. Differential Revision: https://reviews.llvm.org/D60112 llvm-svn: 358321
* Revert "[analyzer] Introduce a simplified API for adding custom path notes."Artem Dergachev2019-03-291-3/+1
| | | | | | | | | | This reverts commit r357323. ASan leaks found by a buildbot :) Differential Revision: https://reviews.llvm.org/D58367 llvm-svn: 357332
* [analyzer] Introduce a simplified API for adding custom path notes.Artem Dergachev2019-03-291-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Almost all path-sensitive checkers need to tell the user when something specific to that checker happens along the execution path but does not constitute a bug on its own. For instance, a call to operator delete in C++ has consequences that are specific to a use-after-free bug. Deleting an object is not a bug on its own, but when the Analyzer finds an execution path on which a deleted object is used, it'll have to explain to the user when exactly during that path did the deallocation take place. Historically such custom notes were added by implementing "bug report visitors". These visitors were post-processing bug reports by visiting every ExplodedNode along the path and emitting path notes whenever they noticed that a change that is relevant to a bug report occurs within the program state. For example, it emits a "memory is deallocated" note when it notices that a pointer changes its state from "allocated" to "deleted". The "visitor" approach is powerful and efficient but hard to use because such preprocessing implies that the developer first models the effects of the event (say, changes the pointer's state from "allocated" to "deleted" as part of operator delete()'s transfer function) and then forgets what happened and later tries to reverse-engineer itself and figure out what did it do by looking at the report. The proposed approach tries to avoid discarding the information that was available when the transfer function was evaluated. Instead, it allows the developer to capture all the necessary information into a closure that will be automatically invoked later in order to produce the actual note. This should reduce boilerplate and avoid very painful logic duplication. On the technical side, the closure is a lambda that's put into a special kind of a program point tag, and a special bug report visitor visits all nodes in the report and invokes all note-producing closures it finds along the path. For now it is up to the lambda to make sure that the note is actually relevant to the report. For instance, a memory deallocation note would be irrelevant when we're reporting a division by zero bug or if we're reporting a use-after-free of a different, unrelated chunk of memory. The lambda can figure these thing out by looking at the bug report object that's passed into it. A single checker is refactored to make use of the new functionality: MIGChecker. Its program state is trivial, making it an easy testing ground for the first version of the API. Differential Revision: https://reviews.llvm.org/D58367 llvm-svn: 357323
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [analyzer] Make sure base-region and its sub-regions are either all alive or ↵Artem Dergachev2019-01-181-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | all dead. SymbolReaper now realizes that our liveness analysis isn't sharp enough to discriminate between liveness of, say, variables and their fields. Surprisingly, this didn't quite work before: having a variable live only through Environment (eg., calling a C++ method on a local variable as the last action ever performed on that variable) would not keep the region value symbol of a field of that variable alive. It would have been broken in the opposite direction as well, but both Environment and RegionStore use the scanReachableSymbols mechanism for finding live symbols regions within their values, and due to that they accidentally end up marking the whole chain of super-regions as live when at least one sub-region is known to be live. It is now a direct responsibility of SymbolReaper to maintain this invariant, and a unit test was added in order to make sure it stays that way. Differential Revision: https://reviews.llvm.org/D56632 rdar://problem/46914108 llvm-svn: 351499
* [analyzer] Assume that we always have a SubEngine availableGabor Horvath2018-12-151-2/+2
| | | | | | | | The removed codepath was dead. Differential Revision: https://reviews.llvm.org/D55697 llvm-svn: 349266
* Misc typos fixes in ./lib folderRaphael Isemann2018-12-101-2/+2
| | | | | | | | | | | | | | Summary: Found via `codespell -q 3 -I ../clang-whitelist.txt -L uint,importd,crasher,gonna,cant,ue,ons,orign,ned` Reviewers: teemperor Reviewed By: teemperor Subscribers: teemperor, jholewinski, jvesely, nhaehnle, whisperity, jfb, cfe-commits Differential Revision: https://reviews.llvm.org/D55475 llvm-svn: 348755
* [analyzer] Dump stable identifiers for objects under construction.Artem Dergachev2018-12-031-2/+10
| | | | | | | | | | This continues the work that was started in r342313, which now gets applied to object-under-construction tracking in C++. Makes it possible to debug temporaries by dumping exploded graphs again. Differential Revision: https://reviews.llvm.org/D54459 llvm-svn: 348200
OpenPOWER on IntegriCloud