summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core
Commit message (Collapse)AuthorAgeFilesLines
...
* Correct hyphenations in comments and assert messagesAlp Toker2013-12-052-4/+4
| | | | | | | This patch tries to avoid unrelated changes other than fixing a few hyphen-related ambiguities in nearby lines. llvm-svn: 196466
* Remove a whole lot of unused variablesAlp Toker2013-11-272-2/+0
| | | | | | | There are about 30 removed in this patch, generated by a new FixIt I haven't got round to submitting yet. llvm-svn: 195814
* [analyzer] Fix an infinite recursion in region invalidation by adding block ↵Anna Zaks2013-11-203-7/+20
| | | | | | count to the BlockDataRegion. llvm-svn: 195174
* [analyzer] Silence warnings coming from allocators used by std::basic_string.Jordan Rose2013-11-151-2/+16
| | | | | | | | | | | | This is similar to r194004: because we can't reason about the data structure invariants of std::basic_string, the analyzer decides it's possible for an allocator to be used to deallocate the string's inline storage. Just ignore this by walking up the stack, skipping past methods in classes with "allocator" in the name, and seeing if we reach std::basic_string that way. PR17866 llvm-svn: 194764
* [analyzer] Include bug column numbers in HTML output (in a comment).Jordan Rose2013-11-151-0/+4
| | | | | | | | | | This has no effect on user-visible output, but can be used by post-processing tools that work with the generated HTML, rather than using CmpRuns.py's interface to work with plists. Patch by György Orbán! llvm-svn: 194763
* [analyzer] Specialize "loop executed 0 times" for for-in and for-range loops.Jordan Rose2013-11-081-2/+13
| | | | | | | | | | The path note that says "Loop body executed 0 times" has been changed to "Loop body skipped when range is empty" for C++11 for-range loops, and to "Loop body skipped when collection is empty" for Objective-C for-in loops. Part of <rdar://problem/14992886> llvm-svn: 194234
* [analyzer] Suppress warnings coming out of std::basic_string.Anna Zaks2013-11-041-0/+12
| | | | | | The analyzer cannot reason about the internal invariances of the data structure (radar://15194597). llvm-svn: 194004
* [analyzer] Don't crash when a path goes through a 'delete' destructor call.Jordan Rose2013-10-311-1/+2
| | | | | | | | | This was just left unimplemnted from r191381; the fix is to report this call location as the location of the 'delete' expr. PR17746 llvm-svn: 193783
* [analyzer] Don't emit an "Assuming x is <OP> y" if it's not a comparison op.Jordan Rose2013-10-261-1/+2
| | | | | | | | | We could certainly be more precise in many of our diagnostics, but before we were printing "Assuming x is && y", which is just ridiculous. <rdar://problem/15167979> llvm-svn: 193455
* [analyzer] Generate a LazyCompoundVal when loading from a union-typed region.Jordan Rose2013-10-231-1/+3
| | | | | | | | | | This ensures that variables accessible through a union are invalidated when the union value is passed to a function. We still don't fully handle union values, but this should at least quiet some false positives. PR16596 llvm-svn: 193265
* [analyzer] Don't draw edges to C++11 in-class member initializers.Jordan Rose2013-10-161-2/+38
| | | | | | | | | | | Since these aren't lexically in the constructor, drawing arrows would be a horrible jump across the body of the class. We could still do better here by skipping over unimportant initializers, but this at least keeps everything within the body of the constructor. <rdar://problem/14960554> llvm-svn: 192818
* [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.Jordan Rose2013-10-071-2/+4
| | | | | | No functionality change. llvm-svn: 192114
* [analyzer] Replace bug category magic strings with shared constants, take 2.Jordan Rose2013-10-043-1/+22
| | | | | | | Re-commit r191910 (reverted in r191936) with layering violation fixed, by moving the bug categories to StaticAnalyzerCore instead of ...Checkers. llvm-svn: 191937
* [analyzer] Make inlining decisions based on the callee being variadic.Jordan Rose2013-09-282-4/+17
| | | | | | | | | | | | ...rather than trying to figure it out from the call site, and having people complain that we guessed wrong and that a prototype-less call is the same as a variadic call on their system. More importantly, fix a crash when there's no decl at the call site (though we could have just returned a default value). <rdar://problem/15037033> llvm-svn: 191599
* [analyzer] Allow pre/post-statement checkers for UnaryOperator.Jordan Rose2013-09-271-20/+30
| | | | | | Found by Arthur Yoo. llvm-svn: 191532
* [analyzer] Handle destructors for the argument to C++ 'delete'.Jordan Rose2013-09-253-2/+29
| | | | | | | | | | | | | | | | | Now that the CFG includes nodes for the destructors in a delete-expression, process them in the analyzer using the same common destructor interface currently used for local, member, and base destructors. Also, check for when the value is known to be null, in which case no destructor is actually run. This does not yet handle destructors for deleted /arrays/, which may need more CFG work. It also causes a slight regression in the location of double delete warnings; the double delete is detected at the destructor call, which is implicit, and so is reported on the first access within the destructor instead of at the 'delete' statement. This will be fixed soon. Patch by Karthik Bhat! llvm-svn: 191381
* StaticAnalyzer/Core/RegionStore.cpp: Prune one last "\param IsConst", as ↵NAKAMURA Takumi2013-09-251-2/+0
| | | | | | fixup to r191342. [-Wdocumentation] llvm-svn: 191360
* [analyzer] This patch removes passing around of const-invalidation vs ↵Anton Yartsev2013-09-246-131/+133
| | | | | | | | | | regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future. With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters. This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker. llvm-svn: 191342
* [analyzer] Use getParentIgnoreParenCasts instead of doing it by hand.Jordan Rose2013-09-201-3/+1
| | | | | | | | | | | | Apart from being more compact and already implemented, this also handles the case where the parent is null. (It does also ignore all casts, not just implicit ones, but this is more efficient to test and in the case we care about---a message in a PseudoObjectExpr---there should only be implicit casts anyway. This should fix our internal buildbot. llvm-svn: 191094
* [analyzer] Don't even try to convert floats to booleans for now.Jordan Rose2013-09-181-0/+4
| | | | | | | | | | | We now have symbols with floating-point type to make sure that (double)x == (double)x comes out true, but we still can't do much with these. For now, don't even bother trying to create a floating-point zero value; just give up on conversion to bool. PR14634, C++ edition. llvm-svn: 190953
* Add the intrinsic __builtin_convertvectorHal Finkel2013-09-181-0/+1
| | | | | | | | | | | | | | | | | | LLVM supports applying conversion instructions to vectors of the same number of elements (fptrunc, fptosi, etc.) but there had been no way for a Clang user to cause such instructions to be generated when using builtin vector types. C-style casting on vectors is already defined in terms of bitcasts, and so cannot be used for these conversions as well (without leading to a very confusing set of semantics). As a result, this adds a __builtin_convertvector intrinsic (patterned after the OpenCL __builtin_astype intrinsic). This is intended to aid the creation of vector intrinsic headers that create generic IR instead of target-dependent intrinsics (in other words, this is a generic _mm_cvtepi32_ps). As noted in the documentation, the action of __builtin_convertvector is defined in terms of the action of a C-style cast on each vector element. llvm-svn: 190915
* [analyzer] More reliably detect property accessors.Anna Zaks2013-09-171-0/+6
| | | | | | | | | This has a side effect of preventing a crash, which occurs because we get a property getter declaration, which is overriding but is declared inside @protocol. Will file a bug about this inconsistency internally. Getting a small test case is very challenging. llvm-svn: 190836
* [analyzer] Run post-stmt checks for DeclStmt.Jordan Rose2013-09-131-1/+4
| | | | | | | | | No tests because no in-tree checkers use this, but that shouldn't stop out-of-tree checkers. Found by Aemon Cannon! llvm-svn: 190650
* [analyzer] Handle zeroing constructors for fields of structs with empty bases.Jordan Rose2013-09-111-4/+13
| | | | | | | | | | | | | | | | | | | RegionStore tries to protect against accidentally initializing the same region twice, but it doesn't take subregions into account very well. If the outer region being initialized is a struct with an empty base class, the offset of the first field in the struct will be 0. When we initialize the base class, we may invalidate the contents of the struct by providing a default value of Unknown (or some new symbol). We then go to initialize the member with a zeroing constructor, only to find that the region at that offset in the struct already has a value. The best we can do here is to invalidate that value and continue; neither the old default value nor the new 0 is correct for the entire struct after the member constructor call. The correct solution for this is to track region extents in the store. <rdar://problem/14914316> llvm-svn: 190530
* Add an implicit dtor CFG node just before C++ 'delete' expressions.Jordan Rose2013-09-032-0/+13
| | | | | | | | | | | | | | This paves the way for adding support for modeling the destructor of a region before it is deleted. The statement "delete <expr>" now generates this series of CFG elements: 1. <expr> 2. [B1.1]->~Foo() (Implicit destructor) 3. delete [B1.1] Patch by Karthik Bhat! llvm-svn: 189828
* [analyzer] Add very limited support for temporary destructorsPavel Labath2013-09-023-5/+31
| | | | | | | | | | | | | | | | | | | | | This is an improved version of r186498. It enables ExprEngine to reason about temporary object destructors. However, these destructor calls are never inlined, since this feature is still broken. Still, this is sufficient to properly handle noreturn temporary destructors. Now, the analyzer correctly handles expressions like "a || A()", and executes the destructor of "A" only on the paths where "a" evaluted to false. Temporary destructor processing is still off by default and one has to explicitly request it by setting cfg-temporary-dtors=true. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1259 llvm-svn: 189746
* [analyzer] Treat the rvalue of a forward-declared struct as Unknown.Jordan Rose2013-08-301-1/+1
| | | | | | | | | | This will never happen in the analyzed code code, but can happen for checkers that over-eagerly dereference pointers without checking that it's safe. UnknownVal is a harmless enough value to get back. Fixes an issue added in r189590, caught by our internal buildbot. llvm-svn: 189688
* [analyzer] Fix handling of "empty" structs with base classesPavel Labath2013-08-291-1/+9
| | | | | | | | | | | | | | | | | | | Summary: RegionStoreManager had an optimization which replaces references to empty structs with UnknownVal. Unfortunately, this check didn't take into account possible field members in base classes. To address this, I changed this test to "is empty and has no base classes". I don't consider it worth the trouble to go through base classes and check if all of them are empty. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1547 llvm-svn: 189590
* [analyzer] Add support for testing the presence of weak functions.Jordan Rose2013-08-285-67/+57
| | | | | | | | | | | | | | | | | | | | | | | | When casting the address of a FunctionTextRegion to bool, or when adding constraints to such an address, use a stand-in symbol to represent the presence or absence of the function if the function is weakly linked. This is groundwork for possible simple availability testing checks, and can already catch mistakes involving inverted null checks for weakly-linked functions. Currently, the implementation reuses the "extent" symbols, originally created for tracking the size of a malloc region. Since FunctionTextRegions cannot be dereferenced, the extent symbol will never be used for anything else. Still, this probably deserves a refactoring in the future. This patch does not attempt to support testing the presence of weak /variables/ (global variables), which would likely require much more of a change and a generalization of "region structure metadata", like the current "extents", vs. "region contents metadata", like CStringChecker's "string length". Patch by Richard <tarka.t.otter@googlemail.com>! llvm-svn: 189492
* [analyzer] Assume new returns non-null even under -fno-exceptionsPavel Labath2013-08-281-4/+7
| | | | | | | | | | | | | | | | | | Summary: -fno-exceptions does not implicitly attach a nothrow specifier to every operator new. Even in this mode, non-nothrow new must not return a null pointer. Failure to allocate memory can be signalled by other means, or just by killing the program. This behaviour is consistent with the compiler - even with -fno-exceptions, the generated code never tests for null (and would segfault if the opeator actually happened to return null). Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1528 llvm-svn: 189452
* Use pop_back_val() instead of both back() and pop_back().Robert Wilhelm2013-08-235-19/+12
| | | | | | No functionality change intended. llvm-svn: 189112
* [analyzer] Refactor conditional expression evaluating codePavel Labath2013-08-232-64/+70
| | | | | | | | | | | | | | | | | | | Summary: Instead of digging through the ExplodedGraph, to figure out which edge brought us here, I compute the value of conditional expression by looking at the sub-expression values. To do this, I needed to change the liveness algorithm a bit -- now, the full conditional expression also depends on all atomic sub-expressions, not only the outermost ones. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1340 llvm-svn: 189090
* Split isFromMainFile into two functions.Eli Friedman2013-08-224-6/+6
| | | | | | | | | Basically, isInMainFile considers line markers, and isWrittenInMainFile doesn't. Distinguishing between the two is useful when dealing with files which are preprocessed files or rewritten with -frewrite-includes (so we don't, for example, print useless warnings). llvm-svn: 188968
* [analyzer] Fix inefficiency in dead symbol removalPavel Labath2013-08-191-17/+19
| | | | | | | | | | | | | | | | | Summary: ScanReachableSymbols uses a "visited" set to avoid scanning the same object twice. However, it did not use the optimization for LazyCompoundVal objects, which resulted in exponential complexity for long chains of temporary objects. Adding this resulted in a decrease of analysis time from >3h to 3 seconds for some files. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1398 llvm-svn: 188677
* Replace some DenseMap keys with simpler structures that don't need another ↵Benjamin Kramer2013-08-161-18/+14
| | | | | | DenseMapInfo specialization. llvm-svn: 188580
* [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.Jordan Rose2013-08-163-74/+0
| | | | | | | | | | | | | | | | | | | | This once again restores notes to following their associated warnings in -analyzer-output=text mode. (This is still only intended for use as a debugging aid.) One twist is that the warning locations in "regular" analysis output modes (plist, multi-file-plist, html, and plist-html) are reported at a different location on the command line than in the output file, since the command line has no path context. This commit makes -analyzer-output=text behave like a normal output format, which means that the *command line output will be different* in -analyzer-text mode. Again, since -analyzer-text is a debugging aid and lo-fi stand-in for a regular output mode, this change makes sense. Along the way, remove a few pieces of stale code related to the path diagnostic consumers. llvm-svn: 188514
* [analyzer] Enable usage of temporaries in InitListExprsPavel Labath2013-08-091-2/+0
| | | | | | | | | | | | | | | | | | Summary: ExprEngine had code which specificaly disabled using CXXTempObjectRegions in InitListExprs. This was a hack put in r168757 to silence a false positive. The underlying problem seems to have been fixed in the mean time, as removing this code doesn't seem to break anything. Therefore I propose to remove it and solve PR16629 in the process. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1325 llvm-svn: 188059
* [analyzer] Clarify that r187624 is a hack and should be fixed better later.Jordan Rose2013-08-051-0/+3
| | | | | | Tracked by <rdar://problem/14648821>. llvm-svn: 187729
* [analyzer] Silently drop all reports within synthesized bodies.Jordan Rose2013-08-011-0/+16
| | | | | | | | | | | | | | | | | | | | | Much of our diagnostic machinery is set up to assume that the report end path location is valid. Moreover, the user may be quite confused when something goes wrong in our BodyFarm-synthesized function bodies, which may be simplified or modified from the real implementations. Rather than try to make this all work somehow, just drop the report so that we don't try to go on with an invalid source location. Note that we still handle reports whose /paths/ go through invalid locations, just not those that are reported in one. We do have to be careful not to lose warnings because of this. The impetus for this change was an autorelease being processed within the synthesized body, and there may be other possible issues that are worth reporting in some way. We'll take these as they come, however. <rdar://problem/14611722> llvm-svn: 187624
* Using the function pointer instead of the function type; this allows us to ↵Aaron Ballman2013-07-271-1/+1
| | | | | | re-enable a warning in MSVC by default. llvm-svn: 187292
* [analyzer] Fix FP warnings when binding a temporary to a local static variablePavel Labath2013-07-262-1/+18
| | | | | | | | | | | | | | | | Summary: When binding a temporary object to a static local variable, the analyzer would complain about a dangling reference even though the temporary's lifetime should be extended past the end of the function. This commit tries to detect these cases and construct them in a global memory region instead of a local one. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1133 llvm-svn: 187196
* [analyzer] Remove dead optimization for MaterializeTemporaryExpr.Jordan Rose2013-07-251-15/+1
| | | | | | | | | | | | | | Previously, we tried to avoid creating new temporary object regions if the value to be materialized itself came from a temporary object region. However, once we became more strict about lvalues vs. rvalues (months ago), this optimization became dead code, because the input to this function will always be an rvalue (i.e. a symbolic value or compound value rather than a region, at least for structs). This would be a nice optimization to keep, but removing it makes it simpler to reason about temporary regions. llvm-svn: 187160
* [analyzer] Weaken assertion to account for pointer-to-integer casts.Jordan Rose2013-07-251-1/+1
| | | | | | PR16690 llvm-svn: 187132
* [analyzer] Enable pseudo-destructor expressions.Jordan Rose2013-07-231-1/+1
| | | | | | | | These are cases where a scalar type is "destructed", usually due to template instantiation (e.g. "obj.~T()", where 'T' is 'int'). This has no actual effect and the analyzer should just skip over it. llvm-svn: 186927
* Revert "[analyzer] Add very limited support for temporary destructors"Jordan Rose2013-07-233-16/+2
| | | | | | | | | | | | The analyzer doesn't currently expect CFG blocks with terminators to be empty, but this can happen when generating conditional destructors for a complex logical expression, such as (a && (b || Temp{})). Moreover, the branch conditions for these expressions are not persisted in the state. Even for handling noreturn destructors this needs more work. This reverts r186498. llvm-svn: 186925
* OpenMP: basic support for #pragma omp parallelAlexey Bataev2013-07-191-0/+1
| | | | llvm-svn: 186647
* [analyzer] Include analysis stack in crash traces.Jordan Rose2013-07-193-3/+56
| | | | | | | | | | | | | Sample output: 0. Program arguments: ... 1. <eof> parser at end of file 2. While analyzing stack: #0 void inlined() #1 void test() 3. crash-trace.c:6:3: Error evaluating statement llvm-svn: 186639
* [analyzer] Handle C++11 member initializer expressions.Jordan Rose2013-07-171-8/+14
| | | | | | | | | Previously, we would simply abort the path when we saw a default member initialization; now, we actually attempt to evaluate it. Like default arguments, the contents of these expressions are not actually part of the current function, so we fall back to constant evaluation. llvm-svn: 186521
* [analyzer] Handle C string default values for const char * arguments.Jordan Rose2013-07-172-1/+12
| | | | | | | | | | Previously, SValBuilder knew how to evaluate StringLiterals, but couldn't handle an array-to-pointer decay for constant values. Additionally, RegionStore was being too strict about loading from an array, refusing to return a 'char' value from a 'const char' array. Both of these have been fixed. llvm-svn: 186520
* [analyzer] Treat std::initializer_list as opaque rather than aborting.Jordan Rose2013-07-171-3/+2
| | | | | | | | | | | | | | Previously, the use of a std::initializer_list (actually, a CXXStdInitializerListExpr) would cause the analyzer to give up on the rest of the path. Now, it just uses an opaque symbolic value for the initializer_list and continues on. At some point in the future we can add proper support for initializer_list, with access to the elements in the InitListExpr. <rdar://problem/14340207> llvm-svn: 186519
OpenPOWER on IntegriCloud