summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core
Commit message (Collapse)AuthorAgeFilesLines
...
* Change AnalyzerOptions::mayInlineCXXMemberFunction to default populateTed Kremenek2012-10-021-3/+4
| | | | | | | the config string table. Also setup a test for dumping the analyzer configuration for C++. llvm-svn: 165040
* [analyzer] Allow ObjC ivar lvalues where the base is nil.Jordan Rose2012-10-011-12/+2
| | | | | | | | | | | | | | By analogy with C structs, this seems to be legal, if probably discouraged. It's only if the ivar is read from or written to that there's a problem. Running a program that gets the "address" of an instance variable does in fact return the offset when the base "object" is nil. This isn't a full revert because r164442 includes some diagnostic tweaks as well; those have been kept. This partially reverts r164442 / 08965091770c9b276c238bac2f716eaa4da2dca4. llvm-svn: 164960
* Revert "[analyzer] Check that a member expr is valid even when the result is ↵Jordan Rose2012-10-011-17/+9
| | | | | | | | | | | | | | | | | | | | an lvalue." The original intent of this commit was to catch potential null dereferences early, but it breaks the common "home-grown offsetof" idiom (PR13927): (((struct Foo *)0)->member - ((struct foo *)0)) As it turns out, this appears to be legal in C, per a footnote in C11 6.5.3.2: "Thus, &*E is equivalent to E (even if E is a null pointer)". In C++ this issue is still open: http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_active.html#232 We'll just have to make sure we have good path notes in the future. This reverts r164441 / 9be016dcd1ca3986873a7b66bd4bc027309ceb59. llvm-svn: 164958
* Have AnalyzerOptions::getBooleanOption() stick the matching configTed Kremenek2012-10-013-13/+16
| | | | | | | | string in the config table so that it can be dumped as part of the config dumper. Add a test to show that these options are sticking and can be cross-checked using FileCheck. llvm-svn: 164954
* Reapply "[analyzer] Handle inlined constructors for rvalue temporaries ↵Jordan Rose2012-10-011-1/+8
| | | | | | | | | | | correctly." This is related to but not blocked by <rdar://problem/12137950> ("Return-by-value structs do not have associated regions") This reverts r164875 / 3278d41e17749dbedb204a81ef373499f10251d7. llvm-svn: 164952
* [analyzer] Make ProgramStateManager's SubEngine parameter optional.Jordan Rose2012-10-015-11/+11
| | | | | | | | | It is possible and valid to have a state manager and associated objects without having a SubEngine or checkers. Patch by Olaf Krzikalla! llvm-svn: 164947
* Revert "[analyzer] Create a temporary region for rvalue structs when ↵Jordan Rose2012-09-291-9/+9
| | | | | | | | accessing fields" This reverts commit 6f61df3e7256413dcb99afb9673f4206e3c4992c. llvm-svn: 164877
* Revert "[analyzer] Create a temp region when a method is called on a struct ↵Jordan Rose2012-09-291-31/+22
| | | | | | | | rvalue." This reverts commit 0006ba445962621ed82ec84400a6b978205a3fbc. llvm-svn: 164876
* Revert "[analyzer] Handle inlined constructors for rvalue temporaries ↵Jordan Rose2012-09-291-8/+1
| | | | | | | | correctly." This reverts commit 580cd17f256259f39a382e967173f34d68e73859. llvm-svn: 164875
* [analyzer] Handle inlined constructors for rvalue temporaries correctly.Jordan Rose2012-09-281-1/+8
| | | | | | | | | | | | | | | Previously the analyzer treated all inlined constructors like lvalues, setting the value of the CXXConstructExpr to the newly-constructed region. However, some CXXConstructExprs behave like rvalues -- in particular, the implicit copy constructor into a pass-by-value argument. In this case, we want only the /contents/ of a temporary object to be passed, so that we can use the same "copy each argument into the parameter region" algorithm that we use for scalar arguments. This may change when we start modeling destructors of temporaries, but for now this is the last part of <rdar://problem/12137950>. llvm-svn: 164830
* [analyzer] Create a temp region when a method is called on a struct rvalue.Jordan Rose2012-09-281-22/+31
| | | | | | | | | | | | | An rvalue has no address, but calling a C++ member function requires a 'this' pointer. This commit makes the analyzer create a temporary region in which to store the struct rvalue and use as a 'this' pointer whenever a member function is called on an rvalue, which is essentially what CodeGen does. More of <rdar://problem/12137950>. The last part is tracking down the C++ FIXME in array-struct-region.cpp. llvm-svn: 164829
* [analyzer] Create a temporary region for rvalue structs when accessing fieldsJordan Rose2012-09-281-9/+9
| | | | | | | | | | | | | | | | | Struct rvalues are represented in the analyzer by CompoundVals, LazyCompoundVals, or plain ConjuredSymbols -- none of which have associated regions. If the entire structure is going to persist, this is not a problem -- either the rvalue will be assigned to an existing region, or a MaterializeTemporaryExpr will be present to create a temporary region. However, if we just need a field from the struct, we need to create the temporary region ourselves. This is inspired by the way CodeGen handles calls to temporaries; support for that in the analyzer is coming next. Part of <rdar://problem/12137950> llvm-svn: 164828
* Revert "Use sep instead of ' '."Ted Kremenek2012-09-261-1/+1
| | | | | | This isn't correct, as Jordan correctly points out. llvm-svn: 164711
* Use sep instead of ' '.Ted Kremenek2012-09-261-1/+1
| | | | llvm-svn: 164709
* Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek2012-09-268-21/+19
| | | | llvm-svn: 164661
* Reapply "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose2012-09-252-9/+8
| | | | | | | | | | | | | | | | | | removeDeadBindings." Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. This depends on the previous commit to be correct. Originally applied in r163444, reverted in r164275, now being re-applied. llvm-svn: 164622
* [analyzer] Calculate liveness for symbolic exprs as well as atomic symbols.Jordan Rose2012-09-251-28/+40
| | | | | | | | | | | | | No tests, but this allows the optimization of removing dead constraints. We can then add tests that we don't do this prematurely. <rdar://problem/12333297> Note: the added FIXME to investigate SymbolRegionValue liveness is tracked by <rdar://problem/12368183>. This patch does not change the existing behavior. llvm-svn: 164621
* [analyzer]Prevent infinite recursion(assume->checker:evalAssume->assume)Anna Zaks2012-09-241-1/+3
| | | | | | (Unfortunately, I do not have a good reduced test case for this.) llvm-svn: 164541
* [analyzer] Suppress bugs whose paths go through the return of a null pointer.Jordan Rose2012-09-222-6/+25
| | | | | | | | | | | | | | | | | | | | This is a heuristic intended to greatly reduce the number of false positives resulting from inlining, particularly inlining of generic, defensive C++ methods that live in header files. The suppression is triggered in the cases where we ask to track where a null pointer came from, and it turns out that the source of the null pointer was an inlined function call. This change brings the number of bug reports in LLVM from ~1500 down to around ~300, a much more manageable number. Yes, some true positives may be hidden as well, but from what I looked at the vast majority of silenced reports are false positives, and many of the true issues found by the analyzer are still reported. I'm hoping to improve this heuristic further by adding some exceptions next week (cases in which a bug should still be reported). llvm-svn: 164449
* [analyzer] Track a null value back through FindLastStoreBRVisitor.Jordan Rose2012-09-221-27/+36
| | | | | | | Also, tidy up the other tracking visitors so that they mark the right things as interesting and don't do extra work. llvm-svn: 164448
* [analyzer] Always allow BugReporterVisitors to see the bug path.Jordan Rose2012-09-221-21/+57
| | | | | | | | | | | | | | | | | | Before, PathDiagnosticConsumers that did not support actual path output would (sensibly) cause the generation of the full path to be skipped. However, BugReporterVisitors may want to see the path in order to mark a BugReport as invalid. Now, even for a path generation scheme of 'None' we will still create a trimmed graph and walk backwards through the bug path, doing no work other than passing the nodes to the BugReporterVisitors. This isn't cheap, but it's necessary to properly do suppression when the first path consumer does not support path notes. In the future, we should try only generating the path and visitor-provided path notes once, or at least only creating the trimmed graph once. llvm-svn: 164447
* [analyzer] Allow a BugReport to be marked "invalid" during path generation.Jordan Rose2012-09-222-10/+40
| | | | | | | | | | | | | | | | This is intended to allow visitors to make decisions about whether a BugReport is likely a false positive. Currently there are no visitors making use of this feature, so there are no tests. When a BugReport is marked invalid, the invalidator must provide a key that identifies the invaliation (intended to be the visitor type and a context pointer of some kind). This allows us to reverse the decision later on. Being able to reverse a decision about invalidation gives us more flexibility, and allows us to formulate conditions like "this report is invalid UNLESS the original argument is 'foo'". We can use this to fine-tune our false-positive suppression (coming soon). llvm-svn: 164446
* [analyzer] Look through OpaqueValueExprs when tracking a nil value.Jordan Rose2012-09-221-0/+3
| | | | | | | This allows us to show /why/ a particular object is nil, even when it is wrapped in an OpaqueValueExpr. llvm-svn: 164445
* [analyzer] Better path notes for null pointers passed as arguments.Jordan Rose2012-09-221-7/+53
| | | | | | | | | | | | | Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
* Use llvm::getOrdinalSuffix to print ordinal numbers in diagnostics.Jordan Rose2012-09-221-32/+7
| | | | | | Just a refactoring of common infrastructure. No intended functionality change. llvm-svn: 164443
* [analyzer] Check that an ObjCIvarRefExpr's base is non-null even as an lvalue.Jordan Rose2012-09-222-2/+15
| | | | | | | | | | | Like with struct fields, we want to catch cases like this early, so that we can produce better diagnostics and path notes: PointObj *p = nil; int *px = &p->_x; // should warn here *px = 1; llvm-svn: 164442
* [analyzer] Check that a member expr is valid even when the result is an lvalue.Jordan Rose2012-09-221-9/+17
| | | | | | | | | | | We want to catch cases like this early, so that we can produce better diagnostics and path notes: Point *p = 0; int *px = &p->x; // should warn here *px = 1; llvm-svn: 164441
* Re-enable faux-bodies by default.Ted Kremenek2012-09-211-1/+1
| | | | | | Try this again, now that r164392 is in place. llvm-svn: 164393
* Revert r164364, "Flip "faux-bodies" in the analyzer on by default to flush ↵NAKAMURA Takumi2012-09-211-1/+1
| | | | | | | | out bugs." It crashed test/Analysis/Output/blocks.m on some hosts. llvm-svn: 164368
* Flip "faux-bodies" in the analyzer on by default to flush out bugs.Ted Kremenek2012-09-211-1/+1
| | | | llvm-svn: 164364
* Simplify getRuntimeDefinition() back to taking no arguments.Ted Kremenek2012-09-212-10/+10
| | | | llvm-svn: 164363
* Implement faux-body-synthesis of well-known functions in the static analyzer ↵Ted Kremenek2012-09-215-13/+39
| | | | | | | | | | | | | | | | | | | | | | | when their implementations are unavailable. Start by simulating dispatch_sync(). This change is largely a bunch of plumbing around something very simple. We use AnalysisDeclContext to conjure up a fake function body (using the current ASTContext) when one does not exist. This is controlled under the analyzer-config option "faux-bodies", which is off by default. The plumbing in this patch is largely to pass the necessary machinery around. CallEvent needs the AnalysisDeclContextManager to get the function definition, as one may get conjured up lazily. BugReporter and PathDiagnosticLocation needed to be relaxed to handle invalid locations, as the conjured body has no real source locations. We do some primitive recovery in diagnostic generation to generate some reasonable locations (for arrows and events), but it can be improved. llvm-svn: 164339
* Revert "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose2012-09-202-8/+9
| | | | | | | | | | | | | | | | | removeDeadBindings." While we definitely want this optimization in the future, we're not currently handling constraints on symbolic /expressions/ correctly. These should stay live even if the SymExpr itself is no longer referenced because could recreate an identical SymExpr later. Only once the SymExpr can no longer be recreated -- i.e. a component symbol is dead -- can we safely remove the constraints on it. This liveness issue is tracked by <rdar://problem/12333297>. This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8. llvm-svn: 164275
* [analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks2012-09-172-9/+8
| | | | | | | | | | | in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. llvm-svn: 164046
* [analyzer] Don't reimplement an existing function.Anna Zaks2012-09-131-17/+1
| | | | | | Thanks Jordan. llvm-svn: 163762
* Refactor logic in ExprEngine for detecting 'noreturn' methodsTed Kremenek2012-09-132-58/+9
| | | | | | | | | | in NSException to a helper object in libAnalysis that can also be used by Sema. Not sure if the predicate name 'isImplicitNoReturn' is the best one, but we can massage that later. No functionality change. llvm-svn: 163759
* [analyzer] Do not report use of undef on "return foo();" when the return ↵Anna Zaks2012-09-121-0/+10
| | | | | | | | type is void. Fixes a false positive found by analyzing LLVM code base. llvm-svn: 163750
* [analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks2012-09-122-3/+25
| | | | llvm-svn: 163748
* [analyzer] Fix another use of the address of a temporary, like r163402.Jordan Rose2012-09-121-1/+2
| | | | | | | | | Again, GCC is more aggressive about reusing temporary space than we are, leading to Release build crashes for this undefined behavior. PR13710 (though it may not be the only problem there) llvm-svn: 163747
* [analyzer] Handle when the dynamic type is worse than the static type.Jordan Rose2012-09-121-1/+8
| | | | | | | | | | | | | | | Currently we don't update the dynamic type of a C++ object when it is cast. This can cause the situation above, where the static type of the region is now known to be a subclass of the dynamic type. Once we start updating DynamicTypeInfo in response to the various kinds of casts in C++, we can re-add this assert to make sure we don't miss any cases. This work is tracked by <rdar://problem/12287087>. In -Asserts builds, we will simply not return any runtime definition when our DynamicTypeInfo is known to be incorrect like this. llvm-svn: 163745
* Revert "[analyzer] Use the static type for a virtual call if the dynamic ↵Jordan Rose2012-09-121-10/+3
| | | | | | | | | | | | type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. llvm-svn: 163744
* Fix regression where "looping back to the head of" PathDiagnosticEventsTed Kremenek2012-09-121-12/+7
| | | | | | | | were not emitted. Fixes <rdar://problem/12280665>. llvm-svn: 163683
* PR13811: Add a FunctionParmPackExpr node to handle references to functionRichard Smith2012-09-121-0/+1
| | | | | | | parameter packs where the reference is not being expanded but the pack has been. Previously, Clang would segfault in such cases. llvm-svn: 163672
* Revert "[analyzer] Disable STL inlining. Blocked by PR13724."Jordan Rose2012-09-111-1/+1
| | | | | | | | | | | While PR13724 is still an issue, it's not actually an issue in the STL. We can keep this option around in case there turn out to be widespread false positives due to poor modeling of the C++ standard library functions, but for now we'd like to get more data. This reverts r163633 / c6baadceec1d5148c20ee6c902a102233c547f62. llvm-svn: 163647
* [analyzer] Use the static type for a virtual call if the dynamic type is worse.Jordan Rose2012-09-111-3/+10
| | | | | | | | | | | | | reinterpret_cast does not provide any of the usual type information that static_cast or dynamic_cast provide -- only the new type. This can get us in a situation where the dynamic type info for an object is actually a superclass of the static type, which does not match what CodeGen does at all. In these cases, just fall back to the static type as the best possible type for devirtualization. Should fix the crashes on our internal buildbot. llvm-svn: 163644
* [analyzer] Disable STL inlining. Blocked by PR13724.Anna Zaks2012-09-111-1/+1
| | | | llvm-svn: 163633
* [analyzer] Member function calls that use qualified names are non-virtual.Jordan Rose2012-09-111-0/+12
| | | | | | | | | | | C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> llvm-svn: 163577
* [analyzer] Turn stl inlining back on.Anna Zaks2012-09-101-1/+1
| | | | | | | The one reported bug, which was exposed by stl inlining, is addressed in r163558. llvm-svn: 163574
* [analyzer] Do not count calls to small functions when computing stackAnna Zaks2012-09-101-3/+18
| | | | | | | | | depth. We only want to count how many substantial functions we inlined. This is an improvement to r163558. llvm-svn: 163571
* [analyzer] Add an option to enable/disable objc inlining.Anna Zaks2012-09-102-3/+12
| | | | llvm-svn: 163562
OpenPOWER on IntegriCloud