summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core/PathDiagnostic.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] NFC: Move PathDiagnostic classes to libAnalysis.Artem Dergachev2019-09-111-1215/+0
| | | | | | | | | | | | At this point the PathDiagnostic, PathDiagnosticLocation, PathDiagnosticPiece structures no longer rely on anything specific to Static Analyzer, so we can move them out of it for everybody to use. PathDiagnosticConsumers are still to be handed off. Differential Revision: https://reviews.llvm.org/D67419 llvm-svn: 371661
* [analyzer] NFC: Move resetDiagnosticLocationToMainFile() to BugReporter.Artem Dergachev2019-09-111-64/+0
| | | | | | | | | | This method of PathDiagnostic is a part of Static Analyzer's particular path diagnostic construction scheme. As such, it doesn't belong to the PathDiagnostic class, but to the Analyzer. Differential Revision: https://reviews.llvm.org/D67418 llvm-svn: 371660
* [analyzer] NFC: Move getStmt() and createEndOfPath() out of PathDiagnostic.Artem Dergachev2019-09-111-119/+7
| | | | | | | | | | These static functions deal with ExplodedNodes which is something we don't want the PathDiagnostic interface to know anything about, as it's planned to be moved out of libStaticAnalyzerCore. Differential Revision: https://reviews.llvm.org/D67382 llvm-svn: 371659
* [analyzer] NFC: Re-implement stack hints as a side map in BugReport.Artem Dergachev2019-09-111-65/+0
| | | | | | | | | | That's one of the few random entities in the PathDiagnostic interface that are specific to the Static Analyzer. By moving them out we could let everybody use path diagnostics without linking against Static Analyzer. Differential Revision: https://reviews.llvm.org/D67381 llvm-svn: 371658
* [analyzer] NFC: Introduce sub-classes for path-sensitive and basic reports.Artem Dergachev2019-09-091-2/+3
| | | | | | | | | | | | | Checkers are now required to specify whether they're creating a path-sensitive report or a path-insensitive report by constructing an object of the respective type. This makes BugReporter more independent from the rest of the Static Analyzer because all Analyzer-specific code is now in sub-classes. Differential Revision: https://reviews.llvm.org/D66572 llvm-svn: 371450
* Removed some dead code in BugReporter and related filesDmitri Gribenko2019-08-211-11/+0
| | | | | | | | | | Subscribers: cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D66473 llvm-svn: 369504
* [analyzer] ReturnValueChecker: Model the guaranteed boolean return value of ↵Csaba Dabis2019-07-041-0/+3
| | | | | | | | | | | | | | | | | | | function calls Summary: It models the known LLVM methods paired with their class. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: dschuff, aheejin, mgorny, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63915 llvm-svn: 365103
* [analyzer] [NFC] PathDiagnostic: Create PathDiagnosticPopUpPieceCsaba Dabis2019-05-291-3/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This new piece is similar to our macro expansion printing in HTML reports: On mouse-hover event it pops up on variables. Similar to note pieces it supports `plist` diagnostics as well. It is optional, on by default: `add-pop-up-notes=true`. Extra: In HTML reports `background-color: LemonChiffon` was too light, changed to `PaleGoldenRod`. Reviewers: NoQ, alexfh Reviewed By: NoQ Subscribers: cfe-commits, gerazo, gsd, george.karpenkov, alexfh, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D60670 llvm-svn: 362014
* [Analyzer] Replace `CXXSelfAssignmentBRVisitor` with `NoteTags`Adam Balogh2019-05-281-0/+9
| | | | | | | | | | | | The `cplusplus.SelfAssignment` checker has a visitor that is added to every `BugReport` to mark the to branch of the self assignment operator with e.g. `rhs == *this` and `rhs != *this`. With the new `NoteTag` feature this visitor is not needed anymore. Instead the checker itself marks the two branches using the `NoteTag`s. Differential Revision: https://reviews.llvm.org/D62479 llvm-svn: 361818
* [analyzer] Add a prunable note for skipping vbase inits in subclasses.Artem Dergachev2019-05-241-1/+9
| | | | | | | | | | | | | When initialization of virtual base classes is skipped, we now tell the user about it, because this aspect of C++ isn't very well-known. The implementation is based on the new "note tags" feature (r358781). In order to make use of it, allow note tags to produce prunable notes, and move the note tag factory to CoreEngine. Differential Revision: https://reviews.llvm.org/D61817 llvm-svn: 361682
* [CFG] NFC: Remove implicit conversion from CFGTerminator to Stmt *.Artem Dergachev2019-05-241-1/+1
| | | | | | | | | | | Turn it into a variant class instead. This conversion does indeed save some code but there's a plan to add support for more kinds of terminators that aren't necessarily based on statements, and with those in mind it becomes more and more confusing to have CFGTerminators implicitly convertible to a Stmt *. Differential Revision: https://reviews.llvm.org/D61814 llvm-svn: 361586
* [analyzer] Fix an assertation failure for invalid sourcelocation, add a new ↵Kristof Umann2019-03-141-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | debug checker For a rather short code snippet, if debug.ReportStmts (added in this patch) was enabled, a bug reporter visitor crashed: struct h { operator int(); }; int k() { return h(); } Ultimately, this originated from PathDiagnosticLocation::createMemberLoc, as it didn't handle the case where it's MemberExpr typed parameter returned and invalid SourceLocation for MemberExpr::getMemberLoc. The solution was to find any related valid SourceLocaion, and Stmt::getBeginLoc happens to be just that. Differential Revision: https://reviews.llvm.org/D58777 llvm-svn: 356161
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* Revert "Fix failing MSan bots"George Karpenkov2019-01-181-0/+6
| | | | | | | | This reverts commit 2cedaaef383d8d6142046074ffebc2bb5a914778. Revert with a fix. llvm-svn: 351575
* Fix failing MSan botsVlad Tsyrklevich2019-01-181-6/+0
| | | | | | | Revert r351508-351514, this block of changes introduced a consistent MSan failure on the sanitizer bots. llvm-svn: 351528
* [analyzer] Extend the PathDiagnosticLocation constructor to handle CallExitEndGeorge Karpenkov2019-01-181-0/+6
| | | | | | Differential Revision: https://reviews.llvm.org/D56890 llvm-svn: 351513
* [analyzer] pr38838, pr39976: Fix crash on diagnosing before implicit destructor.Artem Dergachev2019-01-101-0/+2
| | | | | | | | | | | | | | | | | | | We need to be able to emit the diagnostic at PreImplicitCall, and the patch implements this functionality. However, for now the need for emitting such diagnostics is not all that great: it is only necessary to not crash when emitting a false positive due to an unrelated issue of having dead symbol collection not working properly. Coming up with a non-false-positive test seems impossible with the current set of checkers, though it is likely to be needed for good things as well in the future. Differential Revision: https://reviews.llvm.org/D56042 rdar://problem/46911462 llvm-svn: 350907
* [analyzer] [NFC] Remove unused parameters, as found by -Wunused-parameterGeorge Karpenkov2018-09-281-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D52640 llvm-svn: 343353
* [analyzer] Associate diagnostics created in checkEndFunction with a return ↵George Karpenkov2018-09-211-7/+13
| | | | | | | | | | statement, if possible If not possible, use the last line of the declaration, as before. Differential Revision: https://reviews.llvm.org/D52326 llvm-svn: 342768
* Port getLocEnd -> getEndLocStephen Kelly2018-08-091-3/+3
| | | | | | | | | | Reviewers: teemperor! Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D50351 llvm-svn: 339386
* Port getLocStart -> getBeginLocStephen Kelly2018-08-091-9/+9
| | | | | | | | | | Reviewers: teemperor! Subscribers: jholewinski, whisperity, jfb, cfe-commits Differential Revision: https://reviews.llvm.org/D50350 llvm-svn: 339385
* [analyzer][ctu] fix unsortable diagnosticsRafael Stahl2018-07-041-3/+7
| | | | | | | | | | | | | | Summary: In the provided test case the PathDiagnostic compare function was not able to find a difference. Reviewers: xazax.hun, NoQ, dcoughlin, george.karpenkov Reviewed By: george.karpenkov Subscribers: a_sidorin, szepet, rnkovacs, a.sidorin, mikhail.ramalho, cfe-commits Differential Revision: https://reviews.llvm.org/D48474 llvm-svn: 336275
* [analyzer] [NFC] Move ::dump methods from BugReporter.cpp to PathDiagnostics.cppGeorge Karpenkov2018-06-121-0/+81
| | | | | | | | | | BugReporter.cpp is already severely overloaded, and those dump methods are on PathDiagnostics and should belong in the corresponding implementation file. Differential Revision: https://reviews.llvm.org/D48035 llvm-svn: 334541
* [analyzer] Added template argument lists to the Pathdiagnostic outputKristof Umann2018-05-251-2/+50
| | | | | | | | | | | Because template parameter lists were not displayed in the plist output, it was difficult to decide in some cases whether a given checker found a true or a false positive. This patch aims to correct this. Differential Revision: https://reviews.llvm.org/D46933 llvm-svn: 333275
* [analyzer] Enable analysis of WebKit "unified sources".Artem Dergachev2018-04-251-3/+4
| | | | | | | | | | | | | | | | | | | Normally the analyzer begins path-sensitive analysis from functions within the main file, even though the path is allowed to go through any functions within the translation unit. When a recent version of WebKit is compiled, the "unified sources" technique is used, that assumes #including multiple code files into a single main file. Such file would have no functions defined in it, so the analyzer wouldn't be able to find any entry points for path-sensitive analysis. This patch pattern-matches unified file names that are similar to those used by WebKit and allows the analyzer to find entry points in the included code files. A more aggressive/generic approach is being planned as well. Differential Revision: https://reviews.llvm.org/D45839 llvm-svn: 330876
* [CFG] [analyzer] Add construction context to C++ return-by-value call elements.Artem Dergachev2018-03-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new CFGStmt sub-class, CFGCXXRecordTypedCall, which replaces the regular CFGStmt for the respective CallExpr whenever the CFG has additional information to provide regarding the lifetime of the returned value. This additional call site information is represented by a ConstructionContext (which was previously used for CFGConstructor elements) that provides references to CXXBindTemporaryExpr and MaterializeTemporaryExpr that surround the call. This corresponds to the common C++ calling convention solution of providing the target address for constructing the return value as an auxiliary implicit argument during function call. One of the use cases for such extra context at the call site would be to perform any sort of inter-procedural analysis over the CFG that involves functions returning objects by value. In this case the elidable constructor at the return site would construct the object explained by the context at the call site, and its lifetime would also be managed by the caller, not the callee. The extra context would also be useful for properly handling the return-value temporary at the call site, even if the callee is not being analyzed inter-procedurally. Differential Revision: https://reviews.llvm.org/D44120 llvm-svn: 327343
* [analyzer] Add scope information to CFGMaxim Ostapenko2018-03-121-0/+3
| | | | | | | | | | | This patch adds two new CFG elements CFGScopeBegin and CFGScopeEnd that indicate when a local scope begins and ends respectively. We use first VarDecl declared in a scope to uniquely identify it and add CFGScopeBegin and CFGScopeEnd elements into corresponding basic blocks. Differential Revision: https://reviews.llvm.org/D16403 llvm-svn: 327258
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-081-91/+90
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 327074
* Resubmit [analyzer] Support for naive cross translation unit analysisIlya Biryukov2018-03-011-2/+17
| | | | | | | | | | | Originally submitted as r326323 and r326324. Reverted in r326432. Reverting the commit was a mistake. The breakage was due to invalid build files in our internal buildsystem, CMakeLists did not have any cyclic dependencies. llvm-svn: 326439
* Revert "[analyzer] Support for naive cross translation unit analysis"Ilya Biryukov2018-03-011-17/+2
| | | | | | | | | | Also revert "[analyzer] Fix a compiler warning" This reverts commits r326323 and r326324. Reason: the commits introduced a cyclic dependency in the build graph. This happens to work with cmake, but breaks out internal integrate. llvm-svn: 326432
* [analyzer] Support for naive cross translation unit analysisGabor Horvath2018-02-281-2/+17
| | | | | | | | | | | | | | | | | | The aim of this patch is to be minimal to enable incremental development of the feature on the top of the tree. This patch should be an NFC when the feature is turned off. It is turned off by default and still considered as experimental. Technical details are available in the EuroLLVM Talk: http://llvm.org/devmtg/2017-03//2017/02/20/accepted-sessions.html#7 Note that the initial prototype was done by A. Sidorin et al.: http://lists.llvm.org/pipermail/cfe-dev/2015-October/045730.html Contributions to the measurements and the new version of the code: Peter Szecsi, Zoltan Gera, Daniel Krupp, Kareem Khazem. Differential Revision: https://reviews.llvm.org/D30691 llvm-svn: 326323
* [analyzer] Implement path notes for temporary destructors.Artem Dergachev2018-02-151-2/+8
| | | | | | | | | | | | | | Temporary destructors fire at the end of the full-expression. It is reasonable to attach the path note for entering/leaving the temporary destructor to its CXXBindTemporaryExpr. This would not affect lifetime-extended temporaries with their automatic destructors which aren't temporary destructors. The path note may be confusing in the case of destructors after elidable copy constructors. Differential Revision: https://reviews.llvm.org/D43144 llvm-svn: 325284
* [CFG] Add extra context to C++ constructor statement elements.Artem Dergachev2018-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new CFGStmt sub-class, CFGConstructor, which replaces the regular CFGStmt with CXXConstructExpr in it whenever the CFG has additional information to provide regarding what sort of object is being constructed. It is useful for figuring out what memory is initialized in client of the CFG such as the Static Analyzer, which do not operate by recursive AST traversal, but instead rely on the CFG to provide all the information when they need it. Otherwise, the statement that triggers the construction and defines what memory is being initialized would normally occur after the construct-expression, and the client would need to peek to the next CFG element or use statement parent map to understand the necessary facts about the construct-expression. As a proof of concept, CFGConstructors are added for new-expressions and the respective test cases are provided to demonstrate how it works. For now, the only additional data contained in the CFGConstructor element is the "trigger statement", such as new-expression, which is the parent of the constructor. It will be significantly expanded in later commits. The additional data is organized as an auxiliary structure - the "construction context", which is allocated separately from the CFGElement. Differential Revision: https://reviews.llvm.org/D42672 llvm-svn: 324668
* [analyzer] Expose return statement from CallExit program pointGeorge Karpenkov2018-02-021-0/+2
| | | | | | | | | | | | | | | | If the return statement is stored, we might as well allow querying against it. Also fix the bug where the return statement is not stored if there is no return value. This change un-merges two ExplodedNodes during call exit when the state is otherwise identical - the CallExitBegin node itself and the "Bind Return Value"-tagged node. And expose the return statement through getStatement helper function. Differential Revision: https://reviews.llvm.org/D42130 llvm-svn: 324052
* [analyzer] Do not attempt to get the pointee of void*Alexander Shaposhnikov2018-01-241-0/+3
| | | | | | | | | | | | Do not attempt to get the pointee of void* while generating a bug report (otherwise it will trigger an assert inside RegionStoreManager::getBinding assert(!T->isVoidType() && "Attempting to dereference a void pointer!")). Test plan: make check-all Differential revision: https://reviews.llvm.org/D42396 llvm-svn: 323382
* [analyzer] Protect against dereferencing a null pointerAlexander Shaposhnikov2018-01-221-3/+3
| | | | | | | | | | | | | The check (inside StackHintGeneratorForSymbol::getMessage) if (!N) return getMessageForSymbolNotFound() is moved to the beginning of the function. Differential revision: https://reviews.llvm.org/D42388 Test plan: make check-all llvm-svn: 323146
* [analyzer] operator new: Fix path diagnostics around the operator call.Artem Dergachev2018-01-181-1/+4
| | | | | | | | | | | | Implements finding appropriate source locations for intermediate diagnostic pieces in path-sensitive bug reports that need to descend into an inlined operator new() call that was called via new-expression. The diagnostics have worked correctly when operator new() was called "directly". Differential Revision: https://reviews.llvm.org/D41409 rdar://problem/12180598 llvm-svn: 322791
* [analyzer] introduce getSVal(Stmt *) helper on ExplodedNode, make sure the ↵George Karpenkov2018-01-171-5/+3
| | | | | | | | | | | | | | | | | | helper is used consistently In most cases using `N->getState()->getSVal(E, N->getLocationContext())` is ugly, verbose, and also opens up more surface area for bugs if an inconsistent location context is used. This patch introduces a helper on an exploded node, and ensures consistent usage of either `ExplodedNode::getSVal` or `CheckContext::getSVal` across the codebase. As a result, a large number of redundant lines is removed. Differential Revision: https://reviews.llvm.org/D42155 llvm-svn: 322753
* [analyzer] support a mode to only show relevant lines in HTML diagnosticsGeorge Karpenkov2018-01-171-14/+12
| | | | | | | | | | | | | | HTML diagnostics can be an overwhelming blob of pages of code. This patch adds a checkbox which filters this list down to only the lines *relevant* to the counterexample by e.g. skipping branches which analyzer has assumed to be infeasible at a time. The resulting amount of output is much smaller, and often fits on one screen, and also provides a much more readable diagnostics. Differential Revision: https://reviews.llvm.org/D41378 llvm-svn: 322612
* [analyzer] Fix unreachable creating PathDiagnosticLocation with widen-loops=trueDevin Coughlin2017-11-291-0/+9
| | | | | | | | | | | | | In the original design of the analyzer, it was assumed that a BlockEntrance doesn't create a new binding on the Store, but this assumption isn't true when 'widen-loops' is set to true. Fix this by finding an appropriate location BlockEntrace program points. Patch by Henry Wong! Differential Revision: https://reviews.llvm.org/D37187 llvm-svn: 319333
* [CFG] Add LoopExit information to CFGPeter Szecsi2017-08-191-1/+3
| | | | | | | | | | | | | | | | This patch introduces a new CFG element CFGLoopExit that indicate when a loop ends. It does not deal with returnStmts yet (left it as a TODO). It hidden behind a new analyzer-config flag called cfg-loopexit (false by default). Test cases added. The main purpose of this patch right know is to make loop unrolling and loop widening easier and more efficient. However, this information can be useful for future improvements in the StaticAnalyzer core too. Differential Revision: https://reviews.llvm.org/D35668 llvm-svn: 311235
* CFG: Add CFGElement for automatic variables that leave the scopeMatthias Gehre2017-07-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This mimics the implementation for the implicit destructors. The generation of this scope leaving elements is hidden behind a flag to the CFGBuilder, thus it should not affect existing code. Currently, I'm missing a test (it's implicitly tested by the clang-tidy lifetime checker that I'm proposing). I though about a test using debug.DumpCFG, but then I would have to add an option to StaticAnalyzer/Core/AnalyzerOptions to enable the scope leaving CFGElement, which would only be useful to that particular test. Any other ideas how I could make a test for this feature? Reviewers: krememek, jordan_rose Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D15031 llvm-svn: 307759
* [analyzer] Nullability: fix notes around synthesized ObjC property accessors.Artem Dergachev2017-06-051-2/+44
| | | | | | | | | | | | | Nullable-to-nonnull checks used to crash when the custom bug visitor was trying to add its notes to autosynthesized accessors of Objective-C properties. Now we avoid this, mostly automatically outside of checker control, by moving the diagnostic to the parent stack frame where the accessor has been called. Differential revision: https://reviews.llvm.org/D32437 llvm-svn: 304710
* Migrate PathDiagnosticPiece to std::shared_ptrDavid Blaikie2017-01-051-35/+30
| | | | | | | Simplifies and makes explicit the memory ownership model rather than implicitly passing/acquiring ownership. llvm-svn: 291143
* [analyzer] Re-apply r283092, attempt no.4, a small chunk.Artem Dergachev2016-10-071-4/+11
| | | | | | | Define PathDiagnosticNotePiece. The next commit would be able to address the BugReport class code that is pointed to by the msvc crash message. llvm-svn: 283566
* Revert "[analyzer] Try to re-apply r283092 "Extend bug reports with extra notes"Artem Dergachev2016-10-071-11/+4
| | | | | | Vector of smart pointers wasn't the thing that caused msvc crash. llvm-svn: 283537
* [analyzer] Try to re-apply r283092 "Extend bug reports with extra notes"Artem Dergachev2016-10-071-4/+11
| | | | | | | Replace SmallVector<IntrusiveRefCntPtr> with a vector of plain pointers. Would insignificantly increase memory usage. llvm-svn: 283536
* [analyzer] Add explanation why analyzer report is not generated (fix for ↵Anton Yartsev2016-10-061-6/+18
| | | | | | | | | PR12421). Currently if the path diagnostic consumer (e.g HTMLDiagnostics and PlistDiagnostics) do not support cross file diagnostics then the path diagnostic report is silently omitted in the case of cross file diagnostics. The patch adds a little verbosity to Clang in this case. The patch also adds help entry for the "--analyzer-output" driver option. llvm-svn: 283499
* Revert "[analyzer] Extend bug reports with extra notes" to fix Windows bot.Vitaly Buka2016-10-041-11/+4
| | | | | | This reverts commit r283092. llvm-svn: 283180
* [analyzer] Extend bug reports with extra notesArtem Dergachev2016-10-031-4/+11
| | | | | | | | | | | | | | | | | | | | These diagnostics are separate from the path-sensitive engine's path notes, and can be added manually on top of path-sensitive or path-insensitive reports. The new note diagnostics would appear as note:-diagnostic on console and as blue bubbles in scan-build. In plist files they currently do not appear, because format needs to be discussed with plist file users. The analyzer option "-analyzer-config notes-as-events=true" would convert notes to normal path notes, and put them at the beginning of the path. This is a temporary hack to show the new notes in plist files. A few checkers would be updated in subsequent commits, including tests for this new feature. Differential Revision: https://reviews.llvm.org/D24278 llvm-svn: 283092
OpenPOWER on IntegriCloud