summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core/SymbolManager.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [analyzer] Make sure base-region and its sub-regions are either all alive or ↵Artem Dergachev2019-01-181-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | all dead. SymbolReaper now realizes that our liveness analysis isn't sharp enough to discriminate between liveness of, say, variables and their fields. Surprisingly, this didn't quite work before: having a variable live only through Environment (eg., calling a C++ method on a local variable as the last action ever performed on that variable) would not keep the region value symbol of a field of that variable alive. It would have been broken in the opposite direction as well, but both Environment and RegionStore use the scanReachableSymbols mechanism for finding live symbols regions within their values, and due to that they accidentally end up marking the whole chain of super-regions as live when at least one sub-region is known to be live. It is now a direct responsibility of SymbolReaper to maintain this invariant, and a unit test was added in order to make sure it stays that way. Differential Revision: https://reviews.llvm.org/D56632 rdar://problem/46914108 llvm-svn: 351499
* [analyzer] Fix the "Zombie Symbols" bug.Artem Dergachev2018-11-301-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's an old bug that consists in stale references to symbols remaining in the GDM if they disappear from other program state sections as a result of any operation that isn't the actual dead symbol collection. The most common example here is: FILE *fp = fopen("myfile.txt", "w"); fp = 0; // leak of file descriptor In this example the leak were not detected previously because the symbol disappears from the public part of the program state due to evaluating the assignment. For that reason the checker never receives a notification that the symbol is dead, and never reports a leak. This patch not only causes leak false negatives, but also a number of other problems, including false positives on some checkers. What's worse, even though the program state contains a finite number of symbols, the set of symbols that dies is potentially infinite. This means that is impossible to compute the set of all dead symbols to pass off to the checkers for cleaning up their part of the GDM. No longer compute the dead set at all. Disallow iterating over dead symbols. Disallow querying if any symbols are dead. Remove the API for marking symbols as dead, as it is no longer necessary. Update checkers accordingly. Differential Revision: https://reviews.llvm.org/D18860 llvm-svn: 347953
* [analyzer] Fix dumping for SymbolConjured conjured at no particular statement.Artem Dergachev2018-10-221-4/+7
| | | | llvm-svn: 344944
* [analyzer] Further printing improvements: use declarations,George Karpenkov2018-09-151-1/+4
| | | | | | | | skip pointers whenever redundant, use unique prefixes. Differential Revision: https://reviews.llvm.org/D52114 llvm-svn: 342316
* [analyzer] Memoize complexity of SymExprMikhail R. Gadelha2018-07-191-7/+0
| | | | | | | | | | | | | | | | | Summary: This patch introduces a new member to SymExpr, which stores the symbol complexity, avoiding recalculating it every time computeComplexity() is called. Also, increase the complexity of conjured Symbols by one, so it's clear that it has a greater complexity than its underlying symbols. Reviewers: NoQ, george.karpenkov Reviewed By: NoQ, george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D49232 llvm-svn: 337472
* [analyzer] [NFC] A convenient getter for getting a current stack frameGeorge Karpenkov2018-06-271-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D44756 llvm-svn: 335701
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-061-14/+23
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326757
* [analyzer] Dump signed integers in SymIntExpr and IntSymExpr correctlyGabor Horvath2017-10-191-3/+9
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D39048 llvm-svn: 316157
* [analyzer] Print type for SymbolRegionValues when dumping to streamDominic Chen2016-12-051-1/+2
| | | | | | | | | | Reviewers: NoQ, dcoughlin, zaks.anna Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D27365 llvm-svn: 288696
* [analyzer] Add LocationContext information to SymbolMetadata.Artem Dergachev2016-08-171-3/+4
| | | | | | | | | | | | | | | | | | | | | Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 llvm-svn: 278937
* Annotate dump() methods with LLVM_DUMP_METHOD, addressing Richard Smith ↵Yaron Keren2016-01-291-1/+1
| | | | | | r259192 post commit comment. llvm-svn: 259232
* [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.Artem Dergachev2016-01-131-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of these changes is to simplify introduction of definition files for the three hierarchies. 1. For every sub-class C of these classes, its kind in the relevant enumeration is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg: MemRegionKind -> MemRegionValKind RegionValueKind -> SymbolRegionValueKind CastSymbolKind -> SymbolCastKind SymIntKind -> SymIntExprKind 2. MemSpaceRegion used to be inconsistently used as both an abstract base and a particular region. This region class is now an abstract base and no longer occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion, is introduced for handling the unique use case for MemSpaceRegion as "the generic memory space" (when it represents a memory space that holds all executable code). 3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for consisitency with symbol kind ranges. 4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and we already refer to BlockTextRegion as a 'code region' in BlockDataRegion. Differential Revision: http://reviews.llvm.org/D16062 llvm-svn: 257598
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-101-0/+12
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* [analyzer] Apply whitespace cleanups by Honggyu Kim.Ted Kremenek2015-09-081-6/+6
| | | | llvm-svn: 246978
* Wdeprecated: CollectReachableSymbolsCallback are move constructed/returned ↵David Blaikie2015-08-131-2/+0
| | | | | | | | | | | | | | by value, so make sure they're copy/moveable (return by value is in ExprEngine::processPointerEscapedOnBind and any other call to the scanReachableSymbols function template used there) Protect the special members in the base class to avoid slicing, and make derived classes final so these special members don't accidentally become public on an intermediate base which would open up the possibility of slicing again. llvm-svn: 244975
* [C++11] Use 'nullptr'. StaticAnalyzer edition.Craig Topper2014-05-271-3/+3
| | | | llvm-svn: 209642
* Use llvm::DeleteContainerSeconds when possibleReid Kleckner2014-02-191-5/+1
| | | | llvm-svn: 201739
* [analyzer] Add support for testing the presence of weak functions.Jordan Rose2013-08-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | When casting the address of a FunctionTextRegion to bool, or when adding constraints to such an address, use a stand-in symbol to represent the presence or absence of the function if the function is weakly linked. This is groundwork for possible simple availability testing checks, and can already catch mistakes involving inverted null checks for weakly-linked functions. Currently, the implementation reuses the "extent" symbols, originally created for tracking the size of a malloc region. Since FunctionTextRegions cannot be dereferenced, the extent symbol will never be used for anything else. Still, this probably deserves a refactoring in the future. This patch does not attempt to support testing the presence of weak /variables/ (global variables), which would likely require much more of a change and a generalization of "region structure metadata", like the current "extents", vs. "region contents metadata", like CStringChecker's "string length". Patch by Richard <tarka.t.otter@googlemail.com>! llvm-svn: 189492
* Use pop_back_val() instead of both back() and pop_back().Robert Wilhelm2013-08-231-2/+1
| | | | | | No functionality change intended. llvm-svn: 189112
* [analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().Jordan Rose2013-04-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Previously, the analyzer used isIntegerType() everywhere, which uses the C definition of "integer". The C++ predicate with the same behavior is isIntegerOrUnscopedEnumerationType(). However, the analyzer is /really/ using this to ask if it's some sort of "integrally representable" type, i.e. it should include C++11 scoped enumerations as well. hasIntegerRepresentation() sounds like the right predicate, but that includes vectors, which the analyzer represents by its elements. This commit audits all uses of isIntegerType() and replaces them with the general isIntegerOrEnumerationType(), except in some specific cases where it makes sense to exclude scoped enumerations, or any enumerations. These cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>() plus BuiltinType::isInteger(). isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and include/clang/StaticAnalysis. :-) Fixes real assertion failures. PR15703 / <rdar://problem/12350701> llvm-svn: 179081
* [analyzer] Use isLiveRegion to determine when SymbolRegionValue is dead.Anna Zaks2013-03-151-3/+1
| | | | | | | | | | Fixes a FIXME, improves dead symbol collection, suppresses a false positive, which resulted from reusing the same symbol twice for simulation of 2 calls to the same function. Fixing this lead to 2 possible false negatives in CString checker. Since the checker is still alpha and the solution will not require revert of this commit, move the tests to a FIXME section. llvm-svn: 177206
* [analyzer] Include opcode in dumping a SymSymExpr.Jordan Rose2013-03-151-34/+15
| | | | | | For debugging use only; no functionality change. llvm-svn: 177187
* [analyzer] Run remove dead on end of path.Anna Zaks2012-11-031-1/+11
| | | | | | | | | | | | | This will simplify checkers that need to register for leaks. Currently, they have to register for both: check dead and check end of path. I've modified the SymbolReaper to consider everything on the stack dead if the input StackLocationContext is 0. (This is a bit disruptive, so I'd like to flash out all the issues asap.) llvm-svn: 167352
* Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek2012-09-261-5/+6
| | | | llvm-svn: 164661
* Reapply "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose2012-09-251-6/+2
| | | | | | | | | | | | | | | | | | removeDeadBindings." Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. This depends on the previous commit to be correct. Originally applied in r163444, reverted in r164275, now being re-applied. llvm-svn: 164622
* [analyzer] Calculate liveness for symbolic exprs as well as atomic symbols.Jordan Rose2012-09-251-28/+40
| | | | | | | | | | | | | No tests, but this allows the optimization of removing dead constraints. We can then add tests that we don't do this prematurely. <rdar://problem/12333297> Note: the added FIXME to investigate SymbolRegionValue liveness is tracked by <rdar://problem/12368183>. This patch does not change the existing behavior. llvm-svn: 164621
* Revert "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose2012-09-201-2/+6
| | | | | | | | | | | | | | | | | removeDeadBindings." While we definitely want this optimization in the future, we're not currently handling constraints on symbolic /expressions/ correctly. These should stay live even if the SymExpr itself is no longer referenced because could recreate an identical SymExpr later. Only once the SymExpr can no longer be recreated -- i.e. a component symbol is dead -- can we safely remove the constraints on it. This liveness issue is tracked by <rdar://problem/12333297>. This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8. llvm-svn: 164275
* [analyzer] Remove constraints on dead symbols as part of removeDeadBindings.Jordan Rose2012-09-081-6/+2
| | | | | | | | | | | | | Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. llvm-svn: 163444
* Revert "[analyzer] Treat all struct values as regions (even rvalues)."Jordan Rose2012-09-051-0/+3
| | | | | | | | | | | | | | This turned out to have many implications, but what eventually seemed to make it unworkable was the fact that we can get struct values (as LazyCompoundVals) from other places besides return-by-value function calls; that is, we weren't actually able to "treat all struct values as regions" consistently across the entire analyzer core. Hopefully we'll be able to come up with an alternate solution soon. This reverts r163066 / 02df4f0aef142f00d4637cd851e54da2a123ca8e. llvm-svn: 163218
* [analyzer] Treat all struct values as regions (even rvalues).Jordan Rose2012-09-011-3/+0
| | | | | | | | | | | | | | | | | This allows us to correctly symbolicate the fields of structs returned by value, as well as get the proper 'this' value for when methods are called on structs returned by value. This does require a moderately ugly hack in the StoreManager: if we assign a "struct value" to a struct region, that now appears as a Loc value being bound to a region of struct type. We handle this by simply "dereferencing" the struct value region, which should create a LazyCompoundVal. This should fix recent crashes analyzing LLVM and on our internal buildbot. <rdar://problem/12137950> llvm-svn: 163066
* Fix undefined behavior: member function calls where 'this' is a null pointer.Richard Smith2012-08-231-2/+2
| | | | llvm-svn: 162430
* Rename 'getConjuredSymbol*' to 'conjureSymbol*'.Ted Kremenek2012-08-221-5/+5
| | | | | | | | | | No need to have the "get", the word "conjure" is a verb too! Getting a conjured symbol is the same as conjuring one up. This shortening is largely cosmetic, but just this simple changed cleaned up a handful of lines, making them less verbose. llvm-svn: 162348
* [analyzer] Add a complexity bound on history tracking.Anna Zaks2012-05-031-0/+7
| | | | | | (Currently, this is only relevant for tainted data.) llvm-svn: 156050
* [analyzer] Run remove dead bindings right before leaving a function.Anna Zaks2012-04-201-0/+7
| | | | | | | | | | | | | | | | | | | | | This is needed to ensure that we always report issues in the correct function. For example, leaks are identified when we call remove dead bindings. In order to make sure we report a callee's leak in the callee, we have to run the operation in the callee's context. This change required quite a bit of infrastructure work since: - We used to only run remove dead bindings before a given statement; here we need to run it after the last statement in the function. For this, we added additional Program Point and special mode in the SymbolReaper to remove all symbols in context lower than the current one. - The call exit operation turned into a sequence of nodes, which are now guarded by CallExitBegin and CallExitEnd nodes for clarity and convenience. (Sorry for the long diff.) llvm-svn: 155244
* Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek2012-02-171-3/+4
| | | | | | for functions called more than once. llvm-svn: 150849
* [analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek2012-01-061-1/+10
| | | | | | | | | | | | | | | | | | entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). llvm-svn: 147688
* Unweaken vtables as per ↵David Blaikie2011-12-201-0/+4
| | | | | | http://llvm.org/docs/CodingStandards.html#ll_virtual_anch llvm-svn: 146959
* [analyzer] Introduce IntSymExpr, where the integer is on the lhs.Anna Zaks2011-12-101-13/+49
| | | | | | | | Fix a bug in SimpleSValBuilder, where we should swap lhs and rhs when calling generateUnknownVal(), - the function which creates symbolic expressions when data is tainted. The issue is not visible when we only create the expressions for taint since all expressions are commutative from taint perspective. Refactor SymExpr::symbol_iterator::expand() to use a switch instead of a chain of ifs. llvm-svn: 146336
* [analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks2011-12-061-0/+48
| | | | | | for finding dependent symbols for taint. llvm-svn: 145986
* [analyzer] Propagate taint through NonLoc to NonLoc casts.Anna Zaks2011-12-061-0/+22
| | | | | | | | | | | - Created a new SymExpr type - SymbolCast. - SymbolCast is created when we don't know how to simplify a NonLoc to NonLoc casts. - A bit of code refactoring: introduced dispatchCast to have better code reuse, remove a goto. - Updated the test case to showcase the new taint flow. llvm-svn: 145985
* Remove AnalysisContext::getLiveVariables(), and introduce a templatized ↵Ted Kremenek2011-10-071-4/+2
| | | | | | mechanism to lazily create analyses that are attached to AnalysisContext objects. llvm-svn: 141425
* Removing a bunch of dead returns/breaks after llvm_unreachables.David Blaikie2011-09-231-1/+0
| | | | llvm-svn: 140407
* Switch assert(0/false) llvm_unreachable.David Blaikie2011-09-231-1/+1
| | | | llvm-svn: 140367
* Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek2011-08-121-21/+21
| | | | | | and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. llvm-svn: 137537
* [analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can ↵Ted Kremenek2011-08-121-2/+2
| | | | | | | | separate TypedRegions that implement getValueType() from those that don't. Patch by Olaf Krzikalla! llvm-svn: 137498
* Optimizations for Dependent Symbol tracking (as per Ted's code review for ↵Anna Zaks2011-08-121-8/+27
| | | | | | | | | | r137309): 1) Change SymbolDependTy map to keep pointers as data. And other small tweaks like making the DenseMap smaller 64->16 elements; remove removeSymbolDependencies() as it will probably not be used. 2) Do not mark dependents live more then once. llvm-svn: 137401
* Analyzer Core: Adding support for user-defined symbol dependencies. (For ↵Anna Zaks2011-08-111-1/+30
| | | | | | example, the allocated resource symbol only needs to be freed if no error has been returned by the allocator, so a checker might want to make the lifespan of the error code symbol depend on the allocated resource symbol.) Note, by default, the map that holds the dependencies will get destroyed along with the SymbolManager at the end of function exploration. llvm-svn: 137309
* [analyzer] Change SymbolReaper to store region roots implied by the ↵Ted Kremenek2011-08-061-5/+12
| | | | | | | | Environment, allowing it be queried when determining if symbols derived from regions are still live. llvm-svn: 137005
* [analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to ↵Ted Kremenek2011-07-281-5/+28
| | | | | | | | | | | | be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs. The motivation of this large change is to drastically simplify the logic in ExprEngine going forward. Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will need to be fixed over time. There is also some possible performance regression as RemoveDeadBindings will be called frequently; this can also be improved over time. llvm-svn: 136419
OpenPOWER on IntegriCloud