summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix regression in modeling assignments of an address of a variable to ↵Ted Kremenek2013-02-221-3/+1
| | | | | | itself. Fixes <rdar://problem/13226577>. llvm-svn: 175852
* [analyzer] Fix buildbot by not reusing a variable name.Jordan Rose2013-02-221-4/+4
| | | | llvm-svn: 175848
* [analyzer] Make sure a temporary object region matches its initial bindings.Jordan Rose2013-02-211-4/+31
| | | | | | | | | | | | | | | | When creating a temporary region (say, when a struct rvalue is used as the base of a member expr), make sure we account for any derived-to-base casts. We don't actually record these in the LazyCompoundVal that represents the rvalue, but we need to make sure that the temporary region we're creating (a) matches the bindings, and (b) matches its expression. Most of the time this will do exactly the same thing as before, but it fixes spurious "garbage value" warnings introduced in r175234 by the use of lazy bindings to model trivial copy constructors. <rdar://problem/13265460> llvm-svn: 175830
* Simplify code to use castAs rather than getAs + assert.David Blaikie2013-02-211-3/+2
| | | | | | Post commit review feedback on r175812 from Jordan Rose. llvm-svn: 175826
* Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie2013-02-218-93/+88
| | | | | | See r175462 for another example/more details. llvm-svn: 175812
* Replace CFGElement llvm::cast support to be well-defined.David Blaikie2013-02-217-27/+28
| | | | | | See r175462 for another example/more details. llvm-svn: 175796
* StaticAnalyzer/Core: Suppress warnings. [-Wunused-variable, -Wunused-function]NAKAMURA Takumi2013-02-211-2/+3
| | | | llvm-svn: 175721
* Whitespace.NAKAMURA Takumi2013-02-211-1/+1
| | | | llvm-svn: 175720
* [analyzer] Record whether a base object region represents a virtual base.Jordan Rose2013-02-214-50/+65
| | | | | | | | | This allows MemRegion and MemRegionManager to avoid asking over and over again whether an class is a virtual base or a non-virtual base. Minor optimization/cleanup; no functionality change. llvm-svn: 175716
* [analyzer] Tidy up a few uses of Optional in RegionStore.Jordan Rose2013-02-211-10/+7
| | | | | | | | | Some that I just added needed conversion to use 'None', others looked better using Optional<SVal>::create. No functionality change. llvm-svn: 175714
* Use None rather than Optional<T>() where possible.David Blaikie2013-02-212-10/+10
| | | | llvm-svn: 175705
* [analyzer] Tighten up safety in the use of lazy bindings.Jordan Rose2013-02-211-71/+79
| | | | | | | | | | | | | | | - When deciding if we can reuse a lazy binding, make sure to check if there are additional bindings in the sub-region. - When reading from a lazy binding, don't accidentally strip off casts or base object regions. This slows down lazy binding reading a bit but is necessary for type sanity when treating one class as another. A bit of minor refactoring allowed these two checks to be unified in a nice early-return-using helper function. <rdar://problem/13239840> llvm-svn: 175703
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-2017-112/+92
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Use op-> directly rather than via Optional<T>::getPointer.David Blaikie2013-02-201-2/+2
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175677
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-2017-237/+255
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* [analyzer] Account for the "interesting values" hash table resizing.Jordan Rose2013-02-201-3/+3
| | | | | | | | | | | RegionStoreManager::getInterestingValues() returns a pointer to a std::vector that lives inside a DenseMap, which is constructed on demand. However, constructing one such value can lead to constructing another value, which will invalidate the reference created earlier. Fixed by delaying the new entry creation until the function returns. llvm-svn: 175582
* [analyzer] Don't accidentally strip off base object regions for lazy bindings.Jordan Rose2013-02-191-21/+43
| | | | | | | | | | | | If a base object is at a 0 offset, RegionStoreManager may find a lazy binding for the entire object, then try to attach a FieldRegion or grandparent CXXBaseObjectRegion on top of that (skipping the intermediate region). We now preserve as many layers of base object regions necessary to make the types match. <rdar://problem/13239840> llvm-svn: 175556
* [analyzer] Don't assert when mixing reinterpret_cast and derived-to-base casts.Jordan Rose2013-02-151-0/+25
| | | | | | | | | | | | | | | This just adds a very simple check that if a DerivedToBase CastExpr is operating on a value with known C++ object type, and that type is not the base type specified in the AST, then the cast is invalid and we should return UnknownVal. In the future, perhaps we can have a checker that specifies that this is illegal, but we still shouldn't assert even if the user turns that checker off. PR14872 llvm-svn: 175239
* Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."Jordan Rose2013-02-152-14/+75
| | | | | | | | | | | | | | ...after a host of optimizations related to the use of LazyCompoundVals (our implementation of aggregate binds). Originally applied in r173951. Reverted in r174069 because it was causing hangs. Re-applied in r174212. Reverted in r174265 because it was /still/ causing hangs. If this needs to be reverted again it will be punted to far in the future. llvm-svn: 175234
* [analyzer] Cache the bindings accessible through a LazyCompoundVal.Jordan Rose2013-02-151-30/+68
| | | | | | | This means we don't have to recompute them all later for every removeDeadSymbols check. llvm-svn: 175233
* [analyzer] Scan the correct store when finding symbols in a LazyCompoundVal.Jordan Rose2013-02-151-2/+10
| | | | | | | | Previously, we were scanning the current store. Now, we properly scan the store that the LazyCompoundVal came from, which may have very different live symbols. llvm-svn: 175232
* [analyzer] Tweak LazyCompoundVal reuse check to ignore qualifiers.Jordan Rose2013-02-151-1/+1
| | | | | | This is optimization only; no behavioral change. llvm-svn: 175231
* [analyzer] Use collectSubRegionKeys to make removeDeadBindings faster.Jordan Rose2013-02-151-19/+33
| | | | | | | | | | | Previously, whenever we had a LazyCompoundVal, we crawled through the entire store snapshot looking for bindings within the LCV's region. Now, we just ask for the subregion bindings of the lazy region and only visit those. This is an optimization (so no test case), but it may allow us to clean up more dead bindings than we were previously. llvm-svn: 175230
* [analyzer] Refactor RegionStore's sub-region bindings traversal.Jordan Rose2013-02-152-46/+82
| | | | | | | | | | | This is going to be used in the next commit. While I'm here, tighten up assumptions about symbolic offset BindingKeys, and make offset calculation explicitly handle all MemRegion kinds. No functionality change. llvm-svn: 175228
* [analyzer] Try constant-evaluation for all variables, not just globals.Jordan Rose2013-02-141-21/+34
| | | | | | | | | | | | | | | | | | | | | In C++, constants captured by lambdas (and blocks) are not actually stored in the closure object, since they can be expanded at compile time. In this case, they will have no binding when we go to look them up. Previously, RegionStore thought they were uninitialized stack variables; now, it checks to see if they are a constant we know how to evaluate, using the same logic as r175026. This particular code path is only for scalar variables. Constant arrays and structs are still unfortunately unhandled; we'll need a stronger solution for those. This may have a small performance impact, but only for truly-undefined local variables, captures in a non-inlined block, and non-constant globals. Even then, in the non-constant case we're only doing a quick type check. <rdar://problem/13105553> llvm-svn: 175194
* [analyzer] Use Clang's evaluation for global constants and default arguments.Jordan Rose2013-02-133-10/+41
| | | | | | | | | | | Previously, we were handling only simple integer constants for globals and the smattering of implicitly-valued expressions handled by Environment for default arguments. Now, we can use any integer constant expression that Clang can evaluate, in addition to everything we handled before. PR15094 / <rdar://problem/12830437> llvm-svn: 175026
* [analyzer] Use makeZeroVal in RegionStore's lazy evaluation of statics.Jordan Rose2013-02-131-23/+19
| | | | | | No functionality change. llvm-svn: 175025
* clang/lib/StaticAnalyzer/Core/BugReporter.cpp: Appease old msvc in ↵NAKAMURA Takumi2013-02-091-1/+2
| | | | | | std::pair(0, 0). llvm-svn: 174792
* Teach BugReporter (extensive diagnostics) to emit a diagnostic when a loop ↵Ted Kremenek2013-02-081-3/+51
| | | | | | | | body is skipped. Fixes <rdar://problem/12322528>. llvm-svn: 174736
* Remove stale instance variable.Ted Kremenek2013-02-081-1/+0
| | | | llvm-svn: 174730
* [analyzer] Remove redundant check as per Jordan's feedback.Anna Zaks2013-02-071-3/+2
| | | | llvm-svn: 174680
* [analyzer] Add pointer escape type param to checkPointerEscape callbackAnna Zaks2013-02-072-6/+15
| | | | | | | | | | | | | | The checkPointerEscape callback previously did not specify how a pointer escaped. This change includes an enum which describes the different ways a pointer may escape. This enum is passed to the checkPointerEscape callback when a pointer escapes. If the escape is due to a function call, the call is passed. This changes previous behavior where the call is passed as NULL if the escape was due to indirectly invalidating the region the pointer referenced. A patch by Branden Archer! llvm-svn: 174677
* [analyzer] Don't reinitialize static globals more than once along a pathAnna Zaks2013-02-071-14/+32
| | | | | | | | | | | This patch makes sure that we do not reinitialize static globals when the function is called more than once along a path. The motivation is code with initialization patterns that rely on 2 static variables, where one of them has an initializer while the other does not. Currently, we reset the static variables with initializers on every visit to the function along a path. llvm-svn: 174676
* [analyzer]Revert part of r161511; suppresses leak false positives in C++Anna Zaks2013-02-061-0/+6
| | | | | | | | | | | This is a "quick fix". The underlining issue is that when a const pointer to a struct is passed into a function, we do not invalidate the pointer fields. This results in false positives that are common in C++ (since copy constructors are prevalent). (Silences two llvm false positives.) llvm-svn: 174468
* Change subexpressions to be visited in the CFG from left-to-right.Ted Kremenek2013-02-052-19/+52
| | | | | | | | | | | | | | | | | This is a more natural order of evaluation, and it is very important for visualization in the static analyzer. Within Xcode, the arrows will not jump from right to left, which looks very visually jarring. It also provides a more natural location for dataflow-based diagnostics. Along the way, we found a case in the analyzer diagnostics where we needed to indicate that a variable was "captured" by a block. -fsyntax-only timings on sqlite3.c show no visible performance change, although this is just one test case. Fixes <rdar://problem/13016513> llvm-svn: 174447
* [analyzer] Teach the analyzer to use a symbol for p when evaluatingAnna Zaks2013-02-051-11/+16
| | | | | | | | (void*)p. Addresses the false positives similar to the test case. llvm-svn: 174436
* Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."Jordan Rose2013-02-022-75/+14
| | | | | | | | | | | ...again. The problem has not been fixed and our internal buildbot is still getting hangs. This reverts r174212, originally applied in r173951, then reverted in r174069. Will not re-apply until the entire project analyzes successfully on my local machine. llvm-svn: 174265
* [analyzer] Always inline functions with bodies generated by BodyFarm.Anna Zaks2013-02-021-1/+15
| | | | | | | | Inlining these functions is essential for correctness. We often have cases where we do not inline calls. For example, the shallow mode and when reanalyzing previously inlined ObjC methods as top level. llvm-svn: 174245
* [analyzer] Fix typo.Anna Zaks2013-02-021-1/+1
| | | | llvm-svn: 174243
* Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."Jordan Rose2013-02-012-14/+75
| | | | | | | | With the optimization in the previous commit, this should be safe again. Originally applied in r173951, then reverted in r174069. llvm-svn: 174212
* [analyzer] Reuse a LazyCompoundVal if its type matches the new region.Jordan Rose2013-02-012-35/+26
| | | | | | | | | | | | | | | | | This allows us to keep from chaining LazyCompoundVals in cases like this: CGRect r = CGRectMake(0, 0, 640, 480); CGRect r2 = r; CGRect r3 = r2; Previously we only made this optimization if the struct did not begin with an aggregate member, to make sure that we weren't picking up an LCV for the first field of the struct. But since LazyCompoundVals are typed, we can make that inference directly by comparing types. This is a pure optimization; the test changes are to guard against possible future regressions. llvm-svn: 174211
* Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."Jordan Rose2013-01-312-75/+14
| | | | | | | | | It's causing hangs on our internal analyzer buildbot. Will restore after investigating. This reverts r173951 / baa7ca1142990e1ad6d4e9d2c73adb749ff50789. llvm-svn: 174069
* [analyzer] If a lazy binding is undefined, pretend that it's unknown instead.Jordan Rose2013-01-311-2/+24
| | | | | | | | | | | | | | | | | | | | | | | | This is a hack to work around the fact that we don't track extents for our default bindings: CGPoint p; p.x = 0.0; p.y = 0.0; rectParam.origin = p; use(rectParam.size); // warning: uninitialized value in rectParam.size.width In this case, the default binding for 'p' gets copied into 'rectParam', because the 'origin' field is at offset 0 within CGRect. From then on, rectParam's old default binding (in this case a symbol) is lost. This patch silences the warning by pretending that lazy bindings are never made from uninitialized memory, but not only is that not true, the original default binding is still getting overwritten (see FIXME test cases). The long-term solution is tracked in <rdar://problem/12701038> PR14765 and <rdar://problem/12875012> llvm-svn: 174031
* [analyzer] Fix a bug in region store that lead to undefined value falseAnna Zaks2013-01-311-16/+8
| | | | | | | | | | positives. The includeSuffix was only set on the first iteration through the function, resulting in invalid regions being produced by getLazyBinding (ex: zoomRegion.y). llvm-svn: 174016
* [analyzer] Make shallow mode more shallow.Anna Zaks2013-01-301-3/+38
| | | | | | | | | | | | | | | | Redefine the shallow mode to inline all functions for which we have a definite definition (ipa=inlining). However, only inline functions that are up to 4 basic blocks large and cut the max exploded nodes generated per top level function in half. This makes shallow faster and allows us to keep inlining small functions. For example, we would keep inlining wrapper functions and constructors/destructors. With the new shallow, it takes 104s to analyze sqlite3, whereas the deep mode is 658s and previous shallow is 209s. llvm-svn: 173958
* [analyzer] Use analyzer config for max-inlinable-size option.Anna Zaks2013-01-302-1/+7
| | | | llvm-svn: 173957
* [analyzer] Move report false positive suppression to report visitors.Anna Zaks2013-01-302-34/+38
| | | | llvm-svn: 173956
* [analyzer] Remove further references to analyzer-ipa.Anna Zaks2013-01-301-2/+2
| | | | | | Thanks Jordan! llvm-svn: 173955
* [analyzer] Model trivial copy/move ctors with an aggregate bind.Jordan Rose2013-01-302-14/+75
| | | | | | | | | | | | | | | | | | | | | | This is faster for the analyzer to process than inlining the constructor and performing a member-wise copy, and it also solves the problem of warning when a partially-initialized POD struct is copied. Before: CGPoint p; p.x = 0; CGPoint p2 = p; <-- assigned value is garbage or undefined After: CGPoint p; p.x = 0; CGPoint p2 = p; // no-warning This matches our behavior in C, where we don't see a field-by-field copy. <rdar://problem/12305288> llvm-svn: 173951
* [analyzer] C++ initializers may require cleanups; look through these.Jordan Rose2013-01-261-1/+1
| | | | | | | | | | | | | | When the analyzer sees an initializer, it checks if the initializer contains a CXXConstructExpr. If so, it trusts that the CXXConstructExpr does the necessary work to initialize the object, and performs no further initialization. This patch looks through any implicit wrapping expressions like ExprWithCleanups to find the CXXConstructExpr inside. Fixes PR15070. llvm-svn: 173557
OpenPOWER on IntegriCloud