summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Core
Commit message (Collapse)AuthorAgeFilesLines
...
* Annotate dump() methods with LLVM_DUMP_METHOD, addressing Richard Smith ↵Yaron Keren2016-01-295-10/+10
| | | | | | r259192 post commit comment. llvm-svn: 259232
* [analyzer] Suppress null reports from defensive checks in function-like macros.Devin Coughlin2016-01-291-1/+26
| | | | | | | | | We already do this for case splits introduced as a result of defensive null checks in functions and methods, so do the same for function-like macros. rdar://problem/19640441 llvm-svn: 259222
* [analyzer] Improve Nullability checker diagnosticsAnna Zaks2016-01-291-0/+7
| | | | | | | | | - Include the position of the argument on which the nullability is violated - Differentiate between a 'method' and a 'function' in the message wording - Test for the error message text in the tests - Fix a bug with setting 'IsDirectDereference' which resulted in regular dereferences assumed to have call context. llvm-svn: 259221
* Removing unnecessary casts; NFC.Aaron Ballman2016-01-291-2/+2
| | | | llvm-svn: 259194
* Remove autoconf supportChris Bieneman2016-01-261-17/+0
| | | | | | | | | | | | | | | | | Summary: This patch is provided in preparation for removing autoconf on 1/26. The proposal to remove autoconf on 1/26 was discussed on the llvm-dev thread here: http://lists.llvm.org/pipermail/llvm-dev/2016-January/093875.html "This is the way [autoconf] ends Not with a bang but a whimper." -T.S. Eliot Reviewers: chandlerc, grosbach, bob.wilson, echristo Subscribers: klimek, cfe-commits Differential Revision: http://reviews.llvm.org/D16472 llvm-svn: 258862
* Fix Clang-tidy modernize-use-nullptr warnings; other minor fixes.Eugene Zelenko2016-01-261-2/+2
| | | | | | Differential revision: http://reviews.llvm.org/D16567 llvm-svn: 258836
* [OpenMP] Parsing + sema for target parallel directive.Arpith Chacko Jacob2016-01-261-0/+1
| | | | | | | | | | | | | Summary: This patch adds parsing + sema for the target parallel directive and its clauses along with testcases. Reviewers: ABataev Differential Revision: http://reviews.llvm.org/D16553 Rebased to current trunk and updated test cases. llvm-svn: 258832
* [analyzer] Utility to match function calls.Gabor Horvath2016-01-221-0/+10
| | | | | | | | This patch adds a small utility to match function calls. This utility abstracts away the mutable keywords and the lazy initialization and caching logic of identifiers from the checkers. The SimpleStreamChecker is ported over this utility within this patch to show the reduction of code and to test this change. Differential Revision: http://reviews.llvm.org/D15921 llvm-svn: 258572
* [OpenMP] Parsing + sema for "target exit data" directive.Samuel Antao2016-01-191-0/+1
| | | | | | Patch by Arpith Jacob. Thanks! llvm-svn: 258177
* [OpenMP] Parsing + sema for "target enter data" directive.Samuel Antao2016-01-191-0/+1
| | | | | | Patch by Arpith Jacob. Thanks! llvm-svn: 258165
* [analyzer] Fix an off-by-one in evalIntegralCast()Artem Dergachev2016-01-181-1/+1
| | | | | | | | | Make sure that we do not add SymbolCast at the very boundary of the range in which the cast would not certainly happen. Differential Revision: http://reviews.llvm.org/D16178 llvm-svn: 258039
* [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.Artem Dergachev2016-01-137-70/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of these changes is to simplify introduction of definition files for the three hierarchies. 1. For every sub-class C of these classes, its kind in the relevant enumeration is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg: MemRegionKind -> MemRegionValKind RegionValueKind -> SymbolRegionValueKind CastSymbolKind -> SymbolCastKind SymIntKind -> SymIntExprKind 2. MemSpaceRegion used to be inconsistently used as both an abstract base and a particular region. This region class is now an abstract base and no longer occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion, is introduced for handling the unique use case for MemSpaceRegion as "the generic memory space" (when it represents a memory space that holds all executable code). 3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for consisitency with symbol kind ranges. 4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and we already refer to BlockTextRegion as a 'code region' in BlockDataRegion. Differential Revision: http://reviews.llvm.org/D16062 llvm-svn: 257598
* [Bugfix] Fix ICE on constexpr vector splat.George Burgess IV2016-01-131-0/+4
| | | | | | | | | | | | | In {CG,}ExprConstant.cpp, we weren't treating vector splats properly. This patch makes us treat splats more properly. Additionally, this patch adds a new cast kind which allows a bool->int cast to result in -1 or 0, instead of 1 or 0 (for true and false, respectively), so we can sanely model OpenCL bool->int casts in the AST. Differential Revision: http://reviews.llvm.org/D14877 llvm-svn: 257559
* [analyzer] Fix RangeConstraintManager's pinning of single value ranges.Pierre Gousseau2016-01-121-2/+2
| | | | | | | | This fix a bug in RangeSet::pin causing single value ranges to be considered non conventionally ordered. Differential Revision: http://reviews.llvm.org/D12901 llvm-svn: 257467
* [analyzer] Evaluate integral casts as cast symbols if truncations are detected.Pierre Gousseau2016-01-122-1/+47
| | | | | | | | | | | | | The current workaround for truncations not being modelled is that the evaluation of integer to integer casts are simply bypassed and so the original symbol is used as the new casted symbol (cf SimpleSValBuilder::evalCastFromNonLoc). This lead to the issue described in PR25078, as the RangeConstraintManager associates ranges with symbols. The new evalIntegralCast method added by this patch wont bypass the cast if it finds the range of the symbol to be greater than the maximum value of the target type. The fix to RangeSet::pin mentioned in the initial review will be committed separately. Differential Revision: http://reviews.llvm.org/D12901 llvm-svn: 257464
* [analyzer] Suppress reports coming from std::__independent_bits_engineAnna Zaks2016-01-061-0/+10
| | | | | | | | | | | | | The analyzer reports a shift by a negative value in the constructor. The bug can be easily triggered by calling std::random_shuffle on a vector (<rdar://problem/19658126>). (The shift by a negative value is reported because __w0_ gets constrained to 63 by the conditions along the path:__w0_ < _WDt && __w0_ >= _WDt-1, where _WDt is 64. In normal execution, __w0_ is not 63, it is 1 and there is no overflow. The path is infeasible, but the analyzer does not know about that.) llvm-svn: 256886
* Small refactoring in CheckerContext::isCLibraryFunction(). NFC.Devin Coughlin2015-12-281-6/+2
| | | | | | | | | | Use getRedeclContext() instead of a manually-written loop and fix a comment. A patch by Aleksei Sidorin! Differential Revision: http://reviews.llvm.org/D15794 llvm-svn: 256524
* [StaticAnalyzer] Use front() and back() instead of dereferencing begin() and ↵Craig Topper2015-12-242-6/+6
| | | | | | rbegin(). Makes the code a little cleaner. NFC llvm-svn: 256358
* [analyzer] Better detect when C++ object was constructed into existing region.Devin Coughlin2015-12-173-38/+101
| | | | | | | | | | | | | | | | | | | | | | | | | When the analyzer evaluates a CXXConstructExpr, it looks ahead in the CFG for the current block to detect what region the object should be constructed into. If the constructor was directly constructed into a local variable or field region then there is no need to explicitly bind the constructed value to the local or field when analyzing the DeclStmt or CXXCtorInitializer that called the constructor. Unfortunately, there were situations in which the CXXConstructExpr was constructed into a temporary region but when evaluating the corresponding DeclStmt or CXXCtorInitializer the analyzer assumed the object was constructed into the local or field. This led to spurious warnings about uninitialized values (PR25777). To avoid these false positives, this commit factors out the logic for determining when a CXXConstructExpr will be directly constructed into existing storage, adds the inverse logic to detect when the corresponding later bind can be safely skipped, and adds assertions to make sure these two checks are in sync. rdar://problem/21947725 llvm-svn: 255859
* Add parse and sema of OpenMP distribute directive with all clauses except ↵Carlo Bertolli2015-12-141-0/+1
| | | | | | dist_schedule llvm-svn: 255498
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-103-5/+18
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* fix typos; NFCSanjay Patel2015-12-091-1/+1
| | | | llvm-svn: 255163
* Reformat linefeeds.NAKAMURA Takumi2015-12-091-4/+1
| | | | llvm-svn: 255098
* Revert r255001, "Add parse and sema for OpenMP distribute directive and all ↵NAKAMURA Takumi2015-12-091-1/+0
| | | | | | | | its clauses excluding dist_schedule." It causes memory leak. Some tests in test/OpenMP would fail. llvm-svn: 255094
* Add parse and sema for OpenMP distribute directive and all its clauses ↵Carlo Bertolli2015-12-081-0/+1
| | | | | | excluding dist_schedule. llvm-svn: 255001
* [analyzer] Fix crash when lambda captures a variable-length array.Devin Coughlin2015-12-071-3/+17
| | | | | | | | | | | | When a C++ lambda captures a variable-length array, it creates a capture field to store the size of the array. The initialization expression for this capture is null, which led the analyzer to crash when initializing the field. To avoid this, use the size expression from the VLA type to determine the initialization value. rdar://problem/23748072 llvm-svn: 254962
* Use llvm::make_range to reduce mentions of iterator type. NFCCraig Topper2015-12-061-2/+1
| | | | llvm-svn: 254870
* [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).Devin Coughlin2015-12-051-12/+13
| | | | | | | | | | This commit prevents MemRegion::getAsOffset() from crashing when the analyzed program casts a symbolic region of a non-record type to some derived type and then attempts to access a field of the base type. rdar://problem/23458069 llvm-svn: 254806
* [analyzer] Improve modelling of nullptr_t in the analyzer. Fix PR25414.Gabor Horvath2015-12-041-0/+17
| | | | | | Differential Revision: http://reviews.llvm.org/D15007 llvm-svn: 254718
* [analyzer] Support inlining lambda-converted blocks.Devin Coughlin2015-12-043-7/+45
| | | | | | | | | clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
* [OPENMP 4.5] Parsing/sema support for 'omp taskloop simd' directive.Alexey Bataev2015-12-031-0/+1
| | | | | | OpenMP 4.5 adds directive 'taskloop simd'. Patch adds parsing/sema analysis for 'taskloop simd' directive and its clauses. llvm-svn: 254597
* [analyzer] Fix IssueHash generation.Gabor Horvath2015-12-013-11/+13
| | | | | | | | Differential Revision: http://reviews.llvm.org/D14919 Original patch by: Gyorgy Orban! llvm-svn: 254394
* [OPENMP 4.5] Parsing/sema analysis for 'taskloop' directive.Alexey Bataev2015-12-011-0/+1
| | | | | | Adds initial parsing and semantic analysis for 'taskloop' directive. llvm-svn: 254367
* [MSVC] 'property' with an empty array in array subscript expression.Alexey Bataev2015-11-251-0/+1
| | | | | | | | | | | | MSVC supports 'property' attribute and allows to apply it to the declaration of an empty array in a class or structure definition. For example: ``` __declspec(property(get=GetX, put=PutX)) int x[]; ``` The above statement indicates that x[] can be used with one or more array indices. In this case, i=p->x[a][b] will be turned into i=p->GetX(a, b), and p->x[a][b] = i will be turned into p->PutX(a, b, i); Differential Revision: http://reviews.llvm.org/D13336 llvm-svn: 254067
* [analyzer] Improve modeling of static initializers.Anna Zaks2015-11-191-4/+10
| | | | | | | | | | | | Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem. The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov! Differential Revision: http://reviews.llvm.org/D14652 llvm-svn: 253532
* [analyzer] Refer to capture field to determine if capture is reference.Devin Coughlin2015-11-151-5/+5
| | | | | | | | | | | | | The analyzer incorrectly treats captures as references if either the original captured variable is a reference or the variable is captured by reference. This causes the analyzer to crash when capturing a reference type by copy (PR24914). Fix this by refering solely to the capture field to determine when a DeclRefExpr for a lambda capture should be treated as a reference type. https://llvm.org/bugs/show_bug.cgi?id=24914 rdar://problem/23524412 llvm-svn: 253157
* [Analyzer] Fix comments and formatting. NFC.Sean Eveson2015-11-102-4/+4
| | | | llvm-svn: 252599
* [analyzer] Fix assertion failure invalidating on const member function calls ↵Devin Coughlin2015-11-091-1/+3
| | | | | | | | (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
* StaticAnalyzer: Remove implicit ilist iterator conversions, NFCDuncan P. N. Exon Smith2015-11-061-6/+6
| | | | | | Remove implicit ilist iterator conversions from clangStaticAnalyzer. llvm-svn: 252360
* [analyzer] Add VforkChecker to find unsafe code in vforked process.Yury Gribov2015-11-061-0/+24
| | | | | | | | | | | | This checker looks for unsafe constructs in vforked process: function calls (excluding whitelist), memory write and returns. This was originally motivated by a vfork-related bug in xtables package. Patch by Yury Gribov. Differential revision: http://reviews.llvm.org/D14014 llvm-svn: 252285
* [analyzer] Update RegionStoreManager::getBinding to handle BlockDataRegionsDevin Coughlin2015-11-051-0/+4
| | | | | | | | | | | | Update RegionStoreManager::getBinding() to return UnknownVal when trying to get the binding for a BlockDataRegion. Previously, getBinding() would try to cast the BlockDataRegion to a TypedValueRegion and crash. This happened when a block was passed as a parameter to an inlined function for which StackHintGeneratorForSymbol::getMessage() tried to generate a stack hint message. rdar://problem/21291971 llvm-svn: 252185
* Fix some Clang-tidy modernize warnings, other minor fixes.Eugene Zelenko2015-11-041-1/+1
| | | | | | Differential revision: http://reviews.llvm.org/D14311 llvm-svn: 252081
* Reapply r251621 "[Analyzer] Widening loops which do not exit"Sean Eveson2015-10-304-1/+94
| | | | | | It was not the cause of the build bot failure. llvm-svn: 251702
* Revert r251621 "[Analyzer] Widening loops which do not exit" (bot failure)Sean Eveson2015-10-304-94/+1
| | | | | | | | Seems to be causing clang-cmake-mips build bot to fail (timeout) http://lab.llvm.org:8011/builders/clang-cmake-mips/builds/10299 llvm-svn: 251697
* [Analyzer] Widening loops which do not exitSean Eveson2015-10-294-1/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Dear All, We have been looking at the following problem, where any code after the constant bound loop is not analyzed because of the limit on how many times the same block is visited, as described in bugzillas #7638 and #23438. This problem is of interest to us because we have identified significant bugs that the checkers are not locating. We have been discussing a solution involving ranges as a longer term project, but I would like to propose a patch to improve the current implementation. Example issue: ``` for (int i = 0; i < 1000; ++i) {...something...} int *p = 0; *p = 0xDEADBEEF; ``` The proposal is to go through the first and last iterations of the loop. The patch creates an exploded node for the approximate last iteration of constant bound loops, before the max loop limit / block visit limit is reached. It does this by identifying the variable in the loop condition and finding the value which is “one away” from the loop being false. For example, if the condition is (x < 10), then an exploded node is created where the value of x is 9. Evaluating the loop body with x = 9 will then result in the analysis continuing after the loop, providing x is incremented. The patch passes all the tests, with some modifications to coverage.c, in order to make the ‘function_which_gives_up’ continue to give up, since the changes allowed the analysis to progress past the loop. This patch does introduce possible false positives, as a result of not knowing the state of variables which might be modified in the loop. I believe that, as a user, I would rather have false positives after loops than do no analysis at all. I understand this may not be the common opinion and am interested in hearing your views. There are also issues regarding break statements, which are not considered. A more advanced implementation of this approach might be able to consider other conditions in the loop, which would allow paths leading to breaks to be analyzed. Lastly, I have performed a study on large code bases and I think there is little benefit in having “max-loop” default to 4 with the patch. For variable bound loops this tends to result in duplicated analysis after the loop, and it makes little difference to any constant bound loop which will do more than a few iterations. It might be beneficial to lower the default to 2, especially for the shallow analysis setting. Please let me know your opinions on this approach to processing constant bound loops and the patch itself. Regards, Sean Eveson SN Systems - Sony Computer Entertainment Group Reviewers: jordan_rose, krememek, xazax.hun, zaks.anna, dcoughlin Subscribers: krememek, xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D12358 llvm-svn: 251621
* [analyzer] Assume escape is possible through system functions taking void*Anna Zaks2015-10-271-12/+29
| | | | | | | | | | | | | | | | | | The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
* [analyzer] Fix lambdas that are capturing constants.Gabor Horvath2015-10-271-7/+14
| | | | llvm-svn: 251407
* [analyzer] Fix another crash when analyzing lambda functions.Gabor Horvath2015-10-271-1/+2
| | | | llvm-svn: 251404
* [coroutines] Creation of promise object, lookup of operator co_await, buildingRichard Smith2015-10-271-0/+4
| | | | | | of await_* calls, and AST representation for same. llvm-svn: 251387
* [analyzer] Fixed a rare crash when analyzing lambda functions.Gabor Horvath2015-10-261-1/+1
| | | | llvm-svn: 251289
OpenPOWER on IntegriCloud