summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Fix false positive on introspection of a block's internal layout.Artem Dergachev2019-12-061-1/+2
| | | | | | When implementation of the block runtime is available, we should not warn that block layout fields are uninitialized simply because they're on the stack.
* [analyzer] Fix analyzer warnings on analyzer.Artem Dergachev2019-08-281-3/+2
| | | | | | | | | Write tests for the actual crash that was found. Write comments and refactor code around 17 style bugs and suppress 3 false positives. Differential Revision: https://reviews.llvm.org/D66847 llvm-svn: 370246
* [analyzer] Trust global initializers when analyzing main().Artem Dergachev2019-08-281-16/+58
| | | | | | | | | | | | | | | | | If the global variable has an initializer, we'll ignore it because we're usually not analyzing the program from the beginning, which means that the global variable may have changed before we start our analysis. However when we're analyzing main() as the top-level function, we can rely on global initializers to still be valid. At least in C; in C++ we have global constructors that can still break this logic. This patch allows the Static Analyzer to load constant initializers from global variables if the top-level function of the current analysis is main(). Differential Revision: https://reviews.llvm.org/D65361 llvm-svn: 370244
* [Clang] Migrate llvm::make_unique to std::make_uniqueJonas Devlieghere2019-08-141-2/+2
| | | | | | | | | | Now that we've moved to C++14, we no longer need the llvm::make_unique implementation from STLExtras.h. This patch is a mechanical replacement of (hopefully) all the llvm::make_unique instances across the monorepo. Differential revision: https://reviews.llvm.org/D66259 llvm-svn: 368942
* [analyzer] Fix -Wunused-function in NDEBUG builds with #ifdef LLVM_DUMP_METHODFangrui Song2019-07-221-2/+4
| | | | llvm-svn: 366663
* Fix parameter name comments using clang-tidy. NFC.Rui Ueyama2019-07-161-1/+1
| | | | | | | | | | | | | | | | | | | | | This patch applies clang-tidy's bugprone-argument-comment tool to LLVM, clang and lld source trees. Here is how I created this patch: $ git clone https://github.com/llvm/llvm-project.git $ cd llvm-project $ mkdir build $ cd build $ cmake -GNinja -DCMAKE_BUILD_TYPE=Debug \ -DLLVM_ENABLE_PROJECTS='clang;lld;clang-tools-extra' \ -DCMAKE_EXPORT_COMPILE_COMMANDS=On -DLLVM_ENABLE_LLD=On \ -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ../llvm $ ninja $ parallel clang-tidy -checks='-*,bugprone-argument-comment' \ -config='{CheckOptions: [{key: StrictMode, value: 1}]}' -fix \ ::: ../llvm/lib/**/*.{cpp,h} ../clang/lib/**/*.{cpp,h} ../lld/**/*.{cpp,h} llvm-svn: 366177
* [analyzer] print() JSONify: Create pointersCsaba Dabis2019-06-251-3/+3
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63726 llvm-svn: 364271
* [analyzer] exploded-graph-rewriter: Fix escaping StringRegions.Artem Dergachev2019-06-191-2/+4
| | | | | | | | | | | Quotes around StringRegions are now escaped and unescaped correctly, producing valid JSON. Additionally, add a forgotten escape for Store values. Differential Revision: https://reviews.llvm.org/D63519 llvm-svn: 363897
* [analyzer] Fix JSON dumps for store clusters.Artem Dergachev2019-06-191-1/+2
| | | | | | | | | | Include a unique pointer so that it was possible to figure out if it's the same cluster in different program states. This allows comparing dumps of different states against each other. Differential Revision: https://reviews.llvm.org/D63362 llvm-svn: 363896
* [analyzer] print() JSONify: Store implementationCsaba Dabis2019-05-291-30/+52
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D61912 llvm-svn: 361972
* [analyzer] Fix crash when returning C++ objects from ObjC messages-to-nil.Artem Dergachev2019-04-261-1/+8
| | | | | | | | | | | the assertion is in fact incorrect: there is a cornercase in Objective-C++ in which a C++ object is not constructed with a constructor, but merely zero-initialized. Namely, this happens when an Objective-C message is sent to a nil and it is supposed to return a C++ object. Differential Revision: https://reviews.llvm.org/D60988 llvm-svn: 359262
* [analyzer][CrossTU] Extend CTU to VarDecls with initializerRafael Stahl2019-04-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | Summary: The existing CTU mechanism imports `FunctionDecl`s where the definition is available in another TU. This patch extends that to VarDecls, to bind more constants. - Add VarDecl importing functionality to CrossTranslationUnitContext - Import Decls while traversing them in AnalysisConsumer - Add VarDecls to CTU external mappings generator - Name changes from "external function map" to "external definition map" Reviewers: NoQ, dcoughlin, xazax.hun, george.karpenkov, martong Reviewed By: xazax.hun Subscribers: Charusso, baloghadamsoftware, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, george.karpenkov, mgorny, whisperity, szepet, rnkovacs, a.sidorin, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D46421 llvm-svn: 358968
* [analyzer] Make default bindings to variables actually work.Artem Dergachev2019-04-181-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default RegionStore bindings represent values that can be obtained by loading from anywhere within the region, not just the specific offset within the region that they are said to be bound to. For example, default-binding a character \0 to an int (eg., via memset()) means that the whole int is 0, not just that its lower byte is 0. Even though memset and bzero were modeled this way, it didn't work correctly when applied to simple variables. Eg., in int x; memset(x, 0, sizeof(x)); we did produce a default binding, but were unable to read it later, and 'x' was perceived as an uninitialized variable even after memset. At the same time, if we replace 'x' with a variable of a structure or array type, accessing fields or elements of such variable was working correctly, which was enough for most cases. So this was only a problem for variables of simple integer/enumeration/floating-point/pointer types. Fix loading default bindings from RegionStore for regions of simple variables. Add a unit test to document the API contract as well. Differential Revision: https://reviews.llvm.org/D60742 llvm-svn: 358722
* [analyzer] Support C++17 aggregates with bases without constructors.Artem Dergachev2019-03-151-1/+46
| | | | | | | | | | | | RegionStore now knows how to bind a nonloc::CompoundVal that represents the value of an aggregate initializer when it has its initial segment of sub-values correspond to base classes. Additionally, fixes the crash from pr40022. Differential Revision: https://reviews.llvm.org/D59054 llvm-svn: 356222
* Revert "[analyzer] Remove the "postponed" hack, deal with derived symbols..."Artem Dergachev2019-02-061-40/+20
| | | | | | | | | | | | | | This reverts commit r341722. The "postponed" mechanism turns out to be necessary in order to handle situations when a symbolic region is only kept alive by implicit bindings in the Store. Otherwise the region is never scanned by the Store's worklist and the binding gets dropped despite being live, as demonstrated by the newly added tests. Differential Revision: https://reviews.llvm.org/D57554 llvm-svn: 353350
* Replace llvm::isPodLike<...> by llvm::is_trivially_copyable<...>Serge Guelton2019-01-201-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in https://bugs.llvm.org/show_bug.cgi?id=36651, the specialization for isPodLike<std::pair<...>> did not match the expectation of std::is_trivially_copyable which makes the memcpy optimization invalid. This patch renames the llvm::isPodLike trait into llvm::is_trivially_copyable. Unfortunately std::is_trivially_copyable is not portable across compiler / STL versions. So a portable version is provided too. Note that the following specialization were invalid: std::pair<T0, T1> llvm::Optional<T> Tests have been added to assert that former specialization are respected by the standard usage of llvm::is_trivially_copyable, and that when a decent version of std::is_trivially_copyable is available, llvm::is_trivially_copyable is compared to std::is_trivially_copyable. As of this patch, llvm::Optional is no longer considered trivially copyable, even if T is. This is to be fixed in a later patch, as it has impact on a long-running bug (see r347004) Note that GCC warns about this UB, but this got silented by https://reviews.llvm.org/D50296. Differential Revision: https://reviews.llvm.org/D54472 llvm-svn: 351701
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [analyzer] Assume that we always have a SubEngine availableGabor Horvath2018-12-151-5/+3
| | | | | | | | The removed codepath was dead. Differential Revision: https://reviews.llvm.org/D55697 llvm-svn: 349266
* [analyzer] Evaluate all non-checker config options before analysisKristof Umann2018-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | In earlier patches regarding AnalyzerOptions, a lot of effort went into gathering all config options, and changing the interface so that potential misuse can be eliminited. Up until this point, AnalyzerOptions only evaluated an option when it was querried. For example, if we had a "-no-false-positives" flag, AnalyzerOptions would store an Optional field for it that would be None up until somewhere in the code until the flag's getter function is called. However, now that we're confident that we've gathered all configs, we can evaluate off of them before analysis, so we can emit a error on invalid input even if that prticular flag will not matter in that particular run of the analyzer. Another very big benefit of this is that debug.ConfigDumper will now show the value of all configs every single time. Also, almost all options related class have a similar interface, so uniformity is also a benefit. The implementation for errors on invalid input will be commited shorty. Differential Revision: https://reviews.llvm.org/D53692 llvm-svn: 348031
* [analyzer] Fix the "Zombie Symbols" bug.Artem Dergachev2018-11-301-18/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's an old bug that consists in stale references to symbols remaining in the GDM if they disappear from other program state sections as a result of any operation that isn't the actual dead symbol collection. The most common example here is: FILE *fp = fopen("myfile.txt", "w"); fp = 0; // leak of file descriptor In this example the leak were not detected previously because the symbol disappears from the public part of the program state due to evaluating the assignment. For that reason the checker never receives a notification that the symbol is dead, and never reports a leak. This patch not only causes leak false negatives, but also a number of other problems, including false positives on some checkers. What's worse, even though the program state contains a finite number of symbols, the set of symbols that dies is potentially infinite. This means that is impossible to compute the set of all dead symbols to pass off to the checkers for cleaning up their part of the GDM. No longer compute the dead set at all. Disallow iterating over dead symbols. Disallow querying if any symbols are dead. Remove the API for marking symbols as dead, as it is no longer necessary. Update checkers accordingly. Differential Revision: https://reviews.llvm.org/D18860 llvm-svn: 347953
* [analyzer][NFC] Fix some incorrect uses of -analyzer-config optionsKristof Umann2018-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | I'm in the process of refactoring AnalyzerOptions. The main motivation behind here is to emit warnings if an invalid -analyzer-config option is given from the command line, and be able to list them all. In this patch, I found some flags that should've been used as checker options, or have absolutely no mention of in AnalyzerOptions, or are nonexistent. - NonLocalizedStringChecker now uses its "AggressiveReport" flag as a checker option - lib/StaticAnalyzer/Frontend/ModelInjector.cpp now accesses the "model-path" option through a getter in AnalyzerOptions - -analyzer-config path-diagnostics-alternate=false is not a thing, I removed it, - lib/StaticAnalyzer/Checkers/AllocationDiagnostics.cpp and lib/StaticAnalyzer/Checkers/AllocationDiagnostics.h are weird, they actually only contain an option getter. I deleted them, and fixed RetainCountChecker to get it's "leak-diagnostics-reference-allocation" option as a checker option, - "region-store-small-struct-limit" has a proper getter now. Differential Revision: https://reviews.llvm.org/D53276 llvm-svn: 345985
* Fix clang -Wimplicit-fallthrough warnings across llvm, NFCReid Kleckner2018-11-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch should not introduce any behavior changes. It consists of mostly one of two changes: 1. Replacing fall through comments with the LLVM_FALLTHROUGH macro 2. Inserting 'break' before falling through into a case block consisting of only 'break'. We were already using this warning with GCC, but its warning behaves slightly differently. In this patch, the following differences are relevant: 1. GCC recognizes comments that say "fall through" as annotations, clang doesn't 2. GCC doesn't warn on "case N: foo(); default: break;", clang does 3. GCC doesn't warn when the case contains a switch, but falls through the outer case. I will enable the warning separately in a follow-up patch so that it can be cleanly reverted if necessary. Reviewers: alexfh, rsmith, lattner, rtrieu, EricWF, bollu Differential Revision: https://reviews.llvm.org/D53950 llvm-svn: 345882
* [analyzer] [NFC] Remove unused parameters, as found by -Wunused-parameterGeorge Karpenkov2018-09-281-3/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D52640 llvm-svn: 343353
* [analyzer] Remove the "postponed" hack, deal with derived symbols using an ↵George Karpenkov2018-09-071-22/+40
| | | | | | | | | | | | | | | | | | | | extra map The "derived" symbols indicate children fields of a larger symbol. As parents do not have pointers to their children, the garbage collection algorithm the analyzer currently uses adds such symbols into a "postponed" category, and then keeps running through the worklist until the fixed point is reached. The current patch rectifies that by instead using a helper map which stores pointers from parents to children, so that no fixed point calculation is necessary. The current patch yields ~5% improvement in running time on sqlite. Differential Revision: https://reviews.llvm.org/D51397 llvm-svn: 341722
* [analyzer] Support modeling no-op BaseToDerived casts in ExprEngine.Artem Dergachev2018-08-291-1/+3
| | | | | | | | | | | | | | | Introduce a new MemRegion sub-class, CXXDerivedObjectRegion, which is the opposite of CXXBaseObjectRegion, to represent such casts. Such region is a bit weird because it is by design bigger than its super-region. But it's not harmful when it is put on top of a SymbolicRegion that has unknown extent anyway. Offset computation for CXXDerivedObjectRegion and proper modeling of casts still remains to be implemented. Differential Revision: https://reviews.llvm.org/D51191 llvm-svn: 340984
* [analyzer] [NFC] Follow the convention when naming classesGeorge Karpenkov2018-08-291-24/+24
| | | | | | | | Renames InvalidateRegionsWorker and RemoveDeadBindingsWorker Differential Revision: https://reviews.llvm.org/D51324 llvm-svn: 340960
* Invalidate static locals when escaping lambdasGeorge Karpenkov2018-08-101-0/+27
| | | | | | | | | | Lambdas can affect static locals even without an explicit capture. rdar://39537031 Differential Revision: https://reviews.llvm.org/D50368 llvm-svn: 339459
* [analyzer] Use sufficiently large types for index bounds calculation.Artem Dergachev2018-06-281-1/+2
| | | | | | | | | | | | | | | | | The ProgramState::assumeInBound() API is used by checkers to make an assumption that a certain array index is within the array's bounds (i.e. is greater than or equal to 0 and is less than the length of the array). When the type of the index was unspecified by the caller, it assumed that the type is 'int', which caused some indices and sizes to truncate during calculations. Use ArrayIndexTy by default instead, which is used by the analyzer to represent index types and is currently hardcoded to long long. Patch by Bevin Hansson! Differential Revision: https://reviews.llvm.org/D46944 llvm-svn: 335803
* [analyzer] const init: handle non-explicit cases more accuratelyRafael Stahl2018-05-291-5/+18
| | | | | | | | | | | | | | Summary: If the access is out of bounds, return UndefinedVal. If it is missing an explicit init, return the implicit zero value it must have. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D46823 llvm-svn: 333417
* Fixes issue introduced by r331556.Alexander Kornienko2018-05-091-3/+5
| | | | | | | | | | Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357 Patch by Rafael Stahl! Differential revision: https://reviews.llvm.org/D46633 llvm-svn: 331870
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-091-3/+3
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* [analyzer] Invalidate union regions properly. Don't hesitate to load later.Artem Dergachev2018-05-041-6/+1
| | | | | | | | | | | | | | | | | | | We weren't invalidating our unions correctly. The previous behavior in invalidateRegionsWorker::VisitCluster() was to direct-bind an UnknownVal to the union (at offset 0). For that reason we were never actually loading default bindings from our unions, because there never was any default binding to load, and the value that is presumed when there's no default binding to load is usually completely incorrect (eg. UndefinedVal for stack unions). The new behavior is to default-bind a conjured symbol (of irrelevant type) to the union that's being invalidated, similarly to what we do for structures and classes. Then it becomes safe to load the value properly. Differential Revision: https://reviews.llvm.org/D45241 llvm-svn: 331563
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-041-18/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] Treat more const variables and fields as known contants.Artem Dergachev2018-05-041-2/+44
| | | | | | | | | | | | | | | | When loading from a variable or a field that is declared as constant, the analyzer will try to inspect its initializer and constant-fold it. Upon success, the analyzer would skip normal load and return the respective constant. The new behavior also applies to fields/elements of brace-initialized structures and arrays. Patch by Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45774 llvm-svn: 331556
* [analyzer] NFC: Remove unused parameteer of StoreManager::CastRetrievedVal().Artem Dergachev2018-05-041-4/+4
| | | | llvm-svn: 331496
* [analyzer] Do not invalidate the `this` pointer.Henry Wong2018-04-151-0/+3
| | | | | | | | | | | | | | | | | Summary: `this` pointer is not an l-value, although we have modeled `CXXThisRegion` for `this` pointer, we can only bind it once, which is when we start to inline method. And this patch fixes https://bugs.llvm.org/show_bug.cgi?id=35506. In addition, I didn't find any other cases other than loop-widen that could invalidate `this` pointer. Reviewers: NoQ, george.karpenkov, a.sidorin, seaneveson, szepet Reviewed By: NoQ Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45491 llvm-svn: 330095
* [analyzer] Prevent crashing in NonNullParamCheckerGeorge Karpenkov2018-03-021-0/+2
| | | | | | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=36381 rdar://37543426 Turns out, the type passed for the lambda capture was incorrect. One more argument to abandon the getSVal overload which does not require the type information. Differential Revision: https://reviews.llvm.org/D43925 llvm-svn: 326520
* Remove redundant casts. NFCGeorge Burgess IV2018-03-011-2/+2
| | | | | | | | | | | | | | | | | | | So I wrote a clang-tidy check to lint out redundant `isa`, `cast`, and `dyn_cast`s for fun. This is a portion of what it found for clang; I plan to do similar cleanups in LLVM and other subprojects when I find time. Because of the volume of changes, I explicitly avoided making any change that wasn't highly local and obviously correct to me (e.g. we still have a number of foo(cast<Bar>(baz)) that I didn't touch, since overloading is a thing and the cast<Bar> did actually change the type -- just up the class hierarchy). I also tried to leave the types we were cast<>ing to somewhere nearby, in cases where it wasn't locally obvious what we were dealing with before. llvm-svn: 326416
* [analyzer] Remove redundant checkGeorge Karpenkov2018-02-271-2/+0
| | | | | | | | There is no point in assigning void just to crash on it in the next line Differential Revision: https://reviews.llvm.org/D43802 llvm-svn: 326234
* [analyzer] Make isSubRegionOf reflexiveGeorge Karpenkov2018-01-171-2/+2
| | | | | | | | | All usages of isSubRegionOf separately check for reflexive case, and in any case, set theory tells us that each set is a subset of itself. Differential Revision: https://reviews.llvm.org/D42140 llvm-svn: 322752
* [analyzer] Fix zero-initialization of stack VLAs under ObjC ARC.Artem Dergachev2017-12-211-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using ARC, strong, weak, and autoreleasing stack variables are implicitly initialized with nil. This includes variable-length arrays of Objective-C object pointers. However, in the analyzer we don't zero-initialize them. We used to, but it accidentally regressed after r289618. Under ARC, the array variable's initializer within DeclStmt is an ImplicitValueInitExpr. Environment doesn't maintain any bindings for this expression kind - instead it always knows that it's a known constant (0 in our case), so it just returns the known value by calling SValBuilder::makeZeroVal() (see EnvironmentManager::getSVal(). Commit r289618 had introduced reasonable behavior of SValBuilder::makeZeroVal() for the arrays, which produces a zero-length compoundVal{}. When such value is bound to arrays, in RegionStoreManager::bindArray() "remaining" items in the array are default-initialized with zero, as in RegionStoreManager::setImplicitDefaultValue(). The similar mechanism works when an array is initialized by an initializer list that is too short, eg. int a[3] = { 1, 2 }; would result in a[2] initialized with 0. However, in case of variable-length arrays it didn't know if any more items need to be added, because, well, the length is variable. Add the default binding anyway, regardless of how many actually need to be added. We don't really care how many, because the default binding covers the whole array anyway. Differential Revision: https://reviews.llvm.org/D41478 rdar://problem/35477763 llvm-svn: 321290
* [analyzer] In getSVal() API, disable auto-detection of void type as char type.Artem Dergachev2017-12-121-4/+1
| | | | | | | | | | | | | | | | | | This is a follow-up from r314910. When a checker developer attempts to dereference a location in memory through ProgramState::getSVal(Loc) or ProgramState::getSVal(const MemRegion *), without specifying the second optional QualType parameter for the type of the value he tries to find at this location, the type is auto-detected from location type. If the location represents a value beyond a void pointer, we thought that auto-detecting the type as 'char' is a good idea. However, in most practical cases, the correct behavior would be to specify the type explicitly, as it is available from other sources, and the few cases where we actually need to take a 'char' are workarounds rather than an intended behavior. Therefore, try to fail with an easy-to-understand assertion when asked to read from a void pointer location. Differential Revision: https://reviews.llvm.org/D38801 llvm-svn: 320451
* [analyzer] Don't treat lambda-captures float constexprs as undefinedDevin Coughlin2017-12-041-2/+9
| | | | | | | | | | | | | | RegionStore has special logic to evaluate captured constexpr variables. However, if the constexpr initializer cannot be evaluated as an integer, the value is treated as undefined. This leads to false positives when, for example, a constexpr float is captured by a lambda. To fix this, treat a constexpr capture that cannot be evaluated as unknown rather than undefined. rdar://problem/35784662 llvm-svn: 319638
* Add NDEBUG checks around LLVM_DUMP_METHOD functions for Wunused-function ↵Eric Christopher2017-11-161-0/+2
| | | | | | warnings. llvm-svn: 318371
* [analyzer] pr28449: Fix support for various array initializers.Artem Dergachev2017-10-131-8/+5
| | | | | | | | | | | | | | | | | | In some cases the analyzer didn't expect an array-type variable to be initialized with anything other than a string literal. The patch essentially removes the assertion, and ensures relatively sane behavior. There is a bigger problem with these initializers. Currently our memory model (RegionStore) is being ordered to initialize the array with a region that is assumed to be storing the initializer rvalue, and it guesses to copy the contents of that region to the array variable. However, it would make more sense for RegionStore to receive the correct initializer in the first place. This problem isn't addressed with this patch. rdar://problem/27248428 Differential Revision: https://reviews.llvm.org/D23963 llvm-svn: 315750
* [analyzer] Fix autodetection of binding types.Artem Dergachev2017-10-041-8/+11
| | | | | | | | | | | | | | | | | | | | | | | In ProgramState::getSVal(Location, Type) API which dereferences a pointer value, when the optional Type parameter is not supplied and the Location is not typed, type should have been guessed on a best-effort basis by inspecting the Location more deeply. However, this never worked; the auto-detected type was instead a pointer type to the correct type. Fixed the issue and added various test cases to demonstrate which parts of the analyzer were affected (uninitialized pointer argument checker, C++ trivial copy modeling, Google test API modeling checker). Additionally, autodetected void types are automatically replaced with char, in order to simplify checker APIs. Which means that if the location is a void pointer, getSVal() would read the first byte through this pointer and return its symbolic value. Fixes pr34305. Differential Revision: https://reviews.llvm.org/D38358 llvm-svn: 314910
* [CSA] [NFC] Move AnalysisContext.h to AnalysisDeclContext.hGeorge Karpenkov2017-09-061-1/+1
| | | | | | | | | | | | | | The implementation is in AnalysisDeclContext.cpp and the class is called AnalysisDeclContext. Making those match up has numerous benefits, including: - Easier jump from header to/from implementation. - Easily identify filename from class. Differential Revision: https://reviews.llvm.org/D37500 llvm-svn: 312671
* [analyzer] Fix modeling of constructorsAlexander Shaposhnikov2017-08-181-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | This diff fixes analyzer's crash (triggered assert) on the newly added test case. The assert being discussed is assert(!B.lookup(R, BindingKey::Direct)) in lib/StaticAnalyzer/Core/RegionStore.cpp, however the root cause is different. For classes with empty bases the offsets might be tricky. For example, let's assume we have struct S: NonEmptyBase, EmptyBase { ... }; In this case Clang applies empty base class optimization and the offset of EmptyBase will be 0, it can be verified via clang -cc1 -x c++ -v -fdump-record-layouts main.cpp -emit-llvm -o /dev/null. When the analyzer tries to perform zero initialization of EmptyBase it will hit the assert because that region has already been "written" by the constructor of NonEmptyBase. Test plan: make check-all Differential revision: https://reviews.llvm.org/D36851 llvm-svn: 311182
* [analyzer] Support partially tainted records.Artem Dergachev2017-05-291-1/+4
| | | | | | | | | | | | | | | | The analyzer's taint analysis can now reason about structures or arrays originating from taint sources in which only certain sections are tainted. In particular, it also benefits modeling functions like read(), which may read tainted data into a section of a structure, but RegionStore is incapable of expressing the fact that the rest of the structure remains intact, even if we try to model read() directly. Patch by Vlad Tsyrklevich! Differential revision: https://reviews.llvm.org/D28445 llvm-svn: 304162
* [analyzer] Improve subscripting null arrays for catching null dereferences.Artem Dergachev2017-04-241-0/+3
| | | | | | | | | | | | | Array-to-pointer cast now works correctly when the pointer to the array is concrete, eg. null, which allows further symbolic calculations involving such values. Inlined defensive checks are now detected correctly when the resulting null symbol is being array-subscripted before dereference. Differential Revision: https://reviews.llvm.org/D32291 llvm-svn: 301251
OpenPOWER on IntegriCloud