summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core
Commit message (Collapse)AuthorAgeFilesLines
...
* Pull logic to map from VarDecl* to captured region using a helper function. ↵Ted Kremenek2012-12-061-17/+24
| | | | | | WIP. llvm-svn: 169479
* Sort all of Clang's files under 'lib', and fix up the broken headersChandler Carruth2012-12-0420-61/+60
| | | | | | | | | | | | | uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
* Include pruning and general cleanup.Benjamin Kramer2012-12-016-0/+6
| | | | llvm-svn: 169095
* Don't include Type.h in DeclarationName.h.Benjamin Kramer2012-12-011-0/+1
| | | | | | Recursively prune some includes. llvm-svn: 169094
* Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't ↵Benjamin Kramer2012-12-012-1/+3
| | | | | | | | | pull in all the generated Attr code. Required to pull some functions out of line, but this shouldn't have a perf impact. No functionality change. llvm-svn: 169092
* Correctly handle IntegralToBool casts in C++ in the static analyzer. Fixes ↵Ted Kremenek2012-11-291-2/+8
| | | | | | <rdar://problem/12759044>. llvm-svn: 168843
* Remove workaround in RegionStore in r168741 since it is handled more ↵Ted Kremenek2012-11-281-10/+8
| | | | | | generally by r168757. llvm-svn: 168774
* Fix another false positive due to a CXX temporary object appearing in a C ↵Ted Kremenek2012-11-281-2/+4
| | | | | | | | | | | initializer. The stop-gap here is to just drop such objects when processing the InitListExpr. We still need a better solution. Fixes <rdar://problem/12755044>. llvm-svn: 168757
* Provide stop-gap solution to crash reported in PR 14436.Ted Kremenek2012-11-271-8/+10
| | | | | | | | | | | | | This was also covered by <rdar://problem/12753384>. The static analyzer evaluates a CXXConstructExpr within an initializer expression and RegionStore doesn't know how to handle the resulting CXXTempObjectRegion that gets created. We need a better solution than just dropping the value, but we need to better understand how to implement the right semantics here. Thanks to Jordan for his help diagnosing the behavior here. llvm-svn: 168741
* [analyzer] Fix a crash reported in PR 14400.Anna Zaks2012-11-261-1/+2
| | | | | | | | The AllocaRegion did not have the superRegion (based on LocationContext) as part of it's hash. As a consequence, the AllocaRegions from different frames were uniqued to be the same region. llvm-svn: 168599
* [analyzer] Fix a use-after-free introduced in r168019.Jordan Rose2012-11-151-4/+5
| | | | | | | | | | | | | | | | | | | | | | | In code like this: void foo() { bar(); baz(); } ...the location for the call to 'bar()' was being used as a backup location for the call to 'baz()'. This is fine unless the call to 'bar()' is deemed uninteresting and that part of the path deleted. (This looks like a logic error as well, but in practice the only way 'baz()' could have an invalid location is if the entire body of 'foo()' is synthesized, meaning the call to 'bar()' will be using the location of the call to 'foo()' anyway. Nevertheless, the new version better matches the intent of the code.) Found by Matt Beaumont-Gay using ASan. Thanks, Matt! llvm-svn: 168080
* [analyzer] Report leaks at the closing brace of a function body.Jordan Rose2012-11-153-13/+24
| | | | | | | | | | | | | | | | | | | | This fixes a few cases where we'd emit path notes like this: +---+ 1| v p = malloc(len); ^ |2 +---+ In general this should make path notes more consistent and more correct, especially in cases where the leak happens on the false branch of an if that jumps directly to the end of the function. There are a couple places where the leak is reported farther away from the cause; these are usually cases where there are several levels of nested braces before the end of the function. This still matches our current behavior for when there /is/ a statement after all the braces, though. llvm-svn: 168070
* [analyzer] Mark symbol values as dead in the environment.Jordan Rose2012-11-153-20/+37
| | | | | | | | | | | | | | This allows us to properly remove dead bindings at the end of the top-level stack frame, using the ReturnStmt, if there is one, to keep the return value live. This in turn removes the need for a check::EndPath callback in leak checkers. This does cause some changes in the path notes for leak checkers. Previously, a leak would be reported at the location of the closing brace in a function. Now, it gets reported at the last statement. This matches the way leaks are currently reported for inlined functions, but is less than ideal for both. llvm-svn: 168066
* [analyzer] Make sure calls in synthesized functions have valid path locations.Jordan Rose2012-11-152-10/+20
| | | | | | | | | | | | | | | | | | We do this by using the "most recent" good location: if a synthesized function 'A' calls another function 'B', the path notes for the call to 'B' will be placed at the same location as the path note for calling 'A'. Similarly, the call to 'A' will have a note saying "Entered call from...", and now we just don't emit that (since the user doesn't have a body to look at anyway). Previously, we were doing this for the "Calling..." notes, but not for the "Entered call from..." or "Returning to caller". This caused a crash when the path entered and then exiting a call within a synthesized body. <rdar://problem/12657843> llvm-svn: 168019
* [analyzer] Address Jordan's feedback for r167780.Anna Zaks2012-11-131-4/+5
| | | | llvm-svn: 167790
* [analyzer] Follow up to r167762 - precisely determine the adjustmentAnna Zaks2012-11-121-3/+13
| | | | | | | | | | | | | | | | | conditions. The adjustment is needed only in case of dynamic dispatch performed by the analyzer - when the runtime declaration is different from the static one. Document this explicitly in the code (by adding a helper). Also, use canonical Decls to avoid matching against the case where the definition is different from found declaration. This fix suppresses the testcase I added in r167762, so add another testcase to make sure we do test commit r167762. llvm-svn: 167780
* [analyzer] Fix a regression (from r 165079): compare canonical types.Anna Zaks2012-11-121-0/+2
| | | | | | | | | | | Suppresses a leak false positive (radar://12663777). In addition, we'll need to rewrite the adjustReturnValue() method not to return UnknownVal by default, but rather assert in cases we cannot handle. To make it possible, we need to correctly handle some of the edge cases we already know about. llvm-svn: 167762
* [analyzer] When invalidating symbolic offset regions, take fields into account.Jordan Rose2012-11-101-6/+63
| | | | | | | | | | | | | | | | | | | Previously, RegionStore was being VERY conservative in saying that because p[i].x and p[i].y have a concrete base region of 'p', they might overlap. Now, we check the chain of fields back up to the base object and check if they match. This only kicks in when dealing with symbolic offset regions because RegionStore's "base+offset" representation of concrete offset regions loses all information about fields. In cases where all offsets are concrete (s.x and s.y), RegionStore will already do the right thing, but mixing concrete and symbolic offsets can cause bindings to be invalidated that are known to not overlap (e.g. p[0].x and p[i].y). This additional refinement is tracked by <rdar://problem/12676180>. <rdar://problem/12530149> llvm-svn: 167654
* [analyzer] Move convenience REGISTER_*_WITH_PROGRAMSTATE to CheckerContext.hJordan Rose2012-11-053-6/+9
| | | | | | | | | | | | As Anna pointed out, ProgramStateTrait.h is a relatively obscure header, and checker writers may not know to look there to add their own custom state. The base macro that specializes the template remains in ProgramStateTrait.h (REGISTER_TRAIT_WITH_PROGRAMSTATE), which allows the analyzer core to keep using it. llvm-svn: 167385
* StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp: Appease msvc.NAKAMURA Takumi2012-11-031-2/+2
| | | | | | 0 (as nullptr) is incompatible to pointer in type matching on msvc. llvm-svn: 167355
* [analyzer] Run remove dead on end of path.Anna Zaks2012-11-034-8/+65
| | | | | | | | | | | | | This will simplify checkers that need to register for leaks. Currently, they have to register for both: check dead and check end of path. I've modified the SymbolReaper to consider everything on the stack dead if the input StackLocationContext is 0. (This is a bit disruptive, so I'd like to flash out all the issues asap.) llvm-svn: 167352
* [analyzer] Refactor: Remove Pred from NodeBuilderContext.Anna Zaks2012-11-033-12/+12
| | | | | | Node builders should manage the nodes, not the context. llvm-svn: 167350
* [analyzer] Add some convenience accessors to CallEvent, and use them.Jordan Rose2012-11-022-1/+24
| | | | | | | | These are CallEvent-equivalents of helpers already accessible in CheckerContext, as part of making it easier for new checkers to be written using CallEvent rather than raw CallExprs. llvm-svn: 167338
* [analyzer] isCLibraryFunction: check that the function is at TU-scope.Jordan Rose2012-11-021-6/+14
| | | | | | | Also, Decls already carry a pointer to the ASTContext, so there's no need to pass an extra argument to the predicate. llvm-svn: 167337
* [analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose2012-11-023-44/+20
| | | | | | | | | Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. llvm-svn: 167276
* [analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose2012-11-021-2/+2
| | | | | | No functionality change. llvm-svn: 167275
* [analyzer] Let ConstraintManager subclasses provide a more efficient checkNull.Jordan Rose2012-10-312-8/+27
| | | | | | | | | | | Previously, every call to a ConstraintManager's isNull would do a full assumeDual to test feasibility. Now, ConstraintManagers can override checkNull if they have a cheaper way to do the same thing. RangeConstraintManager can do this in less than half the work. <rdar://problem/12608209> llvm-svn: 167138
* [analyzer]Don't invalidate const arguments when there is noAnna Zaks2012-10-311-1/+1
| | | | | | | IdentifierInfo. Ee: C++ copy constructors. llvm-svn: 167092
* [analyzer] New option to not suppress null return paths if an argument is null.Jordan Rose2012-10-293-17/+109
| | | | | | | | | | | | | | | | | | Our one basic suppression heuristic is to assume that functions do not usually return NULL. However, when one of the arguments is NULL it is suddenly much more likely that NULL is a valid return value. In this case, we don't suppress the report here, but we do attach /another/ visitor to go find out if this NULL argument also comes from an inlined function's error path. This new behavior, controlled by the 'avoid-suppressing-null-argument-paths' analyzer-config option, is turned off by default. Turning it on produced two false positives and no new true positives when running over LLVM/Clang. This is one of the possible refinements to our suppression heuristics. <rdar://problem/12350829> llvm-svn: 166941
* [analyzer] Use the CallEnter node to get a value for tracked null arguments.Jordan Rose2012-10-292-27/+50
| | | | | | | | | | | | | | | | Additionally, don't collect PostStore nodes -- they are often used in path diagnostics. Previously, we tried to track null arguments in the same way as any other null values, but in many cases the necessary nodes had already been collected (a memory optimization in ExplodedGraph). Now, we fall back to using the value of the argument at the time of the call, which may not always match the actual contents of the region, but often will. This is a precursor to improving our suppression heuristic. <rdar://problem/12350829> llvm-svn: 166940
* Add comments for RemoveRedundantMsgs, rename it to removeRedundantMsgs() per ↵Ted Kremenek2012-10-261-4/+13
| | | | | | Jordan's feedback. llvm-svn: 166778
* TrackConstraintBRVisitor and ConditionBRVisitor can emit similarTed Kremenek2012-10-252-8/+94
| | | | | | | | | | | | path notes for cases where a value may be assumed to be null, etc. Instead of having redundant diagnostics, do a pass over the generated PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor that are already covered by ConditionBRVisitor, whose notes tend to be better. Fixes <rdar://problem/12252783> llvm-svn: 166728
* [analyzer] Handle 'SomeVar.SomeEnumConstant', which is legal in C++.Jordan Rose2012-10-231-7/+7
| | | | | | | | This caused assertion failures analyzing LLVM. <rdar://problem/12560282> llvm-svn: 166529
* [analyzer] Replace -analyzer-no-eagerly-trim-egraph with graph-trim-interval.Jordan Rose2012-10-233-12/+17
| | | | | | | | | | | | | After every 1000 CFGElements processed, the ExplodedGraph trims out nodes that satisfy a number of criteria for being "boring" (single predecessor, single successor, and more). Rather than controlling this with a cc1 option, which can only disable this behavior, we now have an analyzer-config option, 'graph-trim-interval', which can change this interval from 1000 to something else. Setting the value to 0 disables reclamation. The next commit relies on this behavior to actually test anything. llvm-svn: 166528
* [analyzer] Assume 'new' never returns NULL if it could throw an exception.Jordan Rose2012-10-201-1/+12
| | | | | | | | | | | | | | | | | | | This is actually required by the C++ standard in [basic.stc.dynamic.allocation]p3: If an allocation function declared with a non-throwing exception-specification fails to allocate storage, it shall return a null pointer. Any other allocation function that fails to allocate storage shall indicate failure only by throwing an exception of a type that would match a handler of type std::bad_alloc. We don't bother checking for the specific exception type, but just go off the operator new prototype. This should help with a certain class of lazy initalization false positives. <rdar://problem/12115221> llvm-svn: 166363
* [analyzer] When binding to a ParenExpr, bind to its inner expression instead.Jordan Rose2012-10-171-89/+105
| | | | | | | | | | | | | This actually looks through several kinds of expression, such as OpaqueValueExpr and ExprWithCleanups. The idea is that binding and lookup should be consistent, and so if the environment needs to be modified later, the code doing the modification will not have to manually look through these "transparent" expressions to find the real binding to change. This is necessary for proper updating of struct rvalues as described in the previous commit. llvm-svn: 166121
* [analyzer] Create a temporary region when accessing a struct rvalue.Jordan Rose2012-10-172-36/+51
| | | | | | | | | | | | | | | | | | | | | | In C++, rvalues that need to have their address taken (for example, to be passed to a function by const reference) will be wrapped in a MaterializeTemporaryExpr, which lets CodeGen know to create a temporary region to store this value. However, MaterializeTemporaryExprs are /not/ created when a method is called on an rvalue struct, even though the 'this' pointer needs a valid value. CodeGen works around this by creating a temporary region anyway; now, so does the analyzer. The analyzer also does this when accessing a field of a struct rvalue. This is a little unfortunate, since the rest of the struct will soon be thrown away, but it does make things consistent with the rest of the analyzer. This allows us to bring back the assumption that all known 'this' values are Locs. This is a revised version of r164828-9, reverted in r164876-7. <rdar://problem/12137950> llvm-svn: 166120
* [analyzer] Embed the analyzer version into the plist output.Anna Zaks2012-10-151-3/+7
| | | | llvm-svn: 165994
* [analyzer] Remove the "direct bindings only" Environment lookup.Jordan Rose2012-10-131-11/+1
| | | | | | | | | | | | This was only used by OSAtomicChecker and makes it more difficult to update values for expressions that the environment may look through instead (it's not the same as IgnoreParens). With this gone, we can have bindExpr bind to the inner expression that getSVal will find. Groundwork for <rdar://problem/12137950> llvm-svn: 165866
* [analyzer] Remove unneeded 'inlineCall' checker callback.Jordan Rose2012-10-131-36/+3
| | | | | | | | | | | | | I believe the removed assert in CheckerManager says it best: InlineCall is a special hacky callback to allow intrusive evaluation of the call (which simulates inlining). It is currently only used by OSAtomicChecker and should go away at some point. OSAtomicChecker has gone away; inlineCall can now go away as well! llvm-svn: 165865
* Reapply "[analyzer] Treat fields of unions as having symbolic offsets."Jordan Rose2012-10-101-1/+5
| | | | | | | | This time, actually uncomment the code that's supposed to fix the problem. This reverts r165671 / 8ceb837585ed973dc36fba8dfc57ef60fc8f2735. llvm-svn: 165676
* Temporarily Revert "[analyzer] Treat fields of unions as having symbolic ↵Eric Christopher2012-10-101-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | offsets." Author: Jordan Rose <jordan_rose@apple.com> Date: Wed Oct 10 21:31:21 2012 +0000 [analyzer] Treat fields of unions as having symbolic offsets. This allows only one field to be active at a time in RegionStore. This isn't quite the correct behavior for unions, but it at least would handle the case of "value goes in, value comes out" from the same field. RegionStore currently has a number of places where any access to a union results in UnknownVal being returned. However, it is clearly missing some cases, or the original issue wouldn't have occurred. It is probably now safe to remove those changes, but that's a potentially destabilizing change that should wait for more thorough testing. Fixes PR14054. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165660 91177308-0d34-0410-b5e6-96231b3b80d8 This reverts commit cf9030e480f77ab349672f00ad302e216c26c92c. llvm-svn: 165671
* [analyzer] Treat fields of unions as having symbolic offsets.Jordan Rose2012-10-101-1/+5
| | | | | | | | | | | | | | | | | This allows only one field to be active at a time in RegionStore. This isn't quite the correct behavior for unions, but it at least would handle the case of "value goes in, value comes out" from the same field. RegionStore currently has a number of places where any access to a union results in UnknownVal being returned. However, it is clearly missing some cases, or the original issue wouldn't have occurred. It is probably now safe to remove those changes, but that's a potentially destabilizing change that should wait for more thorough testing. Fixes PR14054. llvm-svn: 165660
* [analyzer] Handle implicit statements used for end-of-path nodes' source locs.Jordan Rose2012-10-061-8/+13
| | | | | | | | | | | Some implicit statements, such as the implicit 'self' inserted for "free" Objective-C ivar access, have invalid source locations. If one of these statements is the location where an issue is reported, we'll now look at the enclosing statements for a valid source location. <rdar://problem/12446776> llvm-svn: 165354
* [analyzer] Adjust the return type of an inlined devirtualized method call.Jordan Rose2012-10-031-5/+56
| | | | | | | | | | | | | | | | | | | | | | | | | In C++, overriding virtual methods are allowed to specify a covariant return type -- that is, if the return type of the base method is an object pointer type (or reference type), the overriding method's return type can be a pointer to a subclass of the original type. The analyzer was failing to take this into account when devirtualizing a method call, and anything that relied on the return value having the proper type later would crash. In Objective-C, overriding methods are allowed to specify ANY return type, meaning we can NEVER be sure that devirtualizing will give us a "safe" return value. Of course, a program that does this will most likely crash at runtime, but the analyzer at least shouldn't crash. The solution is to check and see if the function/method being inlined is the function that static binding would have picked. If not, check that the return value has the same type. If the types don't match, see if we can fix it with a derived-to-base cast (the C++ case). If we can't, return UnknownVal to avoid crashing later. <rdar://problem/12409977> llvm-svn: 165079
* [analyzer] Push evalDynamicCast and evalDerivedToBase up to Store.Jordan Rose2012-10-032-98/+86
| | | | | | | | | These functions are store-agnostic, and would benefit from information in DynamicTypeInfo but gain nothing from the store type. No intended functionality change. llvm-svn: 165078
* Teach getCXXRecordDeclForPointerType about references.Jordan Rose2012-10-031-20/+5
| | | | | | | | | Then, rename it getPointeeCXXRecordDecl and give it a nice doc comment, and actually use it. No intended functionality change. llvm-svn: 165077
* Silence -Wunused-value warning.Ted Kremenek2012-10-021-0/+1
| | | | llvm-svn: 165059
* Refactor clients of AnalyzerOptions::getBooleanOption() to haveTed Kremenek2012-10-021-25/+23
| | | | | | an intermediate helper method to query and populate the Optional value. llvm-svn: 165043
* Tweak AnalyzerOptions::getOptionAsInteger() to populate the stringTed Kremenek2012-10-021-15/+13
| | | | | | | | | table, making it printable with the ConfigDump checker. Along the way, fix a really serious bug where the value was getting parsed from the string in code that was in an assert() call. This means in a Release-Asserts build this code wouldn't work as expected. llvm-svn: 165041
OpenPOWER on IntegriCloud