summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Fix an off-by-one in evalIntegralCast()Artem Dergachev2016-01-181-1/+1
| | | | | | | | | Make sure that we do not add SymbolCast at the very boundary of the range in which the cast would not certainly happen. Differential Revision: http://reviews.llvm.org/D16178 llvm-svn: 258039
* [analyzer] Check for return of nil in ObjC methods with nonnull return type.Devin Coughlin2016-01-151-20/+20
| | | | | | | | | | | | Update NullabilityChecker so that it checks return statements in ObjC methods. Previously it was returning early because methods do not have a function type. Also update detection of violated parameter _Nonnull preconditions to handle ObjC methods. rdar://problem/24200560 llvm-svn: 257938
* [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion, v2.Artem Dergachev2016-01-151-34/+51
| | | | | | | | | | | | | | | | Provide separate visitor templates for the three hierarchies, and also the `FullSValVisitor' class, which is a union of all three visitors. Additionally, add a particular example visitor, `SValExplainer', in order to test the visitor templates. This visitor is capable of explaining the SVal, SymExpr, or MemRegion in a natural language. Compared to the reverted r257605, this fixes the test that used to fail on some triples, and fixes build failure under -fmodules. Differential Revision: http://reviews.llvm.org/D15448 llvm-svn: 257893
* Update for LLVM function name change.Rui Ueyama2016-01-141-2/+2
| | | | llvm-svn: 257802
* Revert "[analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion."Artem Dergachev2016-01-131-51/+34
| | | | | | | | | This reverts commit r257605. The test fails on architectures that use unsigned int as size_t. SymbolManager.h fails with compile errors on some platforms. llvm-svn: 257608
* [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion.Artem Dergachev2016-01-131-34/+51
| | | | | | | | | | | | | Provide separate visitor templates for the three hierarchies, and also the `FullSValVisitor' class, which is a union of all three visitors. Additionally, add a particular example visitor, `SValExplainer', in order to test the visitor templates. This visitor is capable of explaining the SVal, SymExpr, or MemRegion in a natural language. Differential Revision: http://reviews.llvm.org/D15448 llvm-svn: 257605
* [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.Artem Dergachev2016-01-139-76/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of these changes is to simplify introduction of definition files for the three hierarchies. 1. For every sub-class C of these classes, its kind in the relevant enumeration is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg: MemRegionKind -> MemRegionValKind RegionValueKind -> SymbolRegionValueKind CastSymbolKind -> SymbolCastKind SymIntKind -> SymIntExprKind 2. MemSpaceRegion used to be inconsistently used as both an abstract base and a particular region. This region class is now an abstract base and no longer occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion, is introduced for handling the unique use case for MemSpaceRegion as "the generic memory space" (when it represents a memory space that holds all executable code). 3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for consisitency with symbol kind ranges. 4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and we already refer to BlockTextRegion as a 'code region' in BlockDataRegion. Differential Revision: http://reviews.llvm.org/D16062 llvm-svn: 257598
* [Bugfix] Fix ICE on constexpr vector splat.George Burgess IV2016-01-131-0/+4
| | | | | | | | | | | | | In {CG,}ExprConstant.cpp, we weren't treating vector splats properly. This patch makes us treat splats more properly. Additionally, this patch adds a new cast kind which allows a bool->int cast to result in -1 or 0, instead of 1 or 0 (for true and false, respectively), so we can sanely model OpenCL bool->int casts in the AST. Differential Revision: http://reviews.llvm.org/D14877 llvm-svn: 257559
* [analyzer] Fix RangeConstraintManager's pinning of single value ranges.Pierre Gousseau2016-01-121-2/+2
| | | | | | | | This fix a bug in RangeSet::pin causing single value ranges to be considered non conventionally ordered. Differential Revision: http://reviews.llvm.org/D12901 llvm-svn: 257467
* [analyzer] Evaluate integral casts as cast symbols if truncations are detected.Pierre Gousseau2016-01-122-1/+47
| | | | | | | | | | | | | The current workaround for truncations not being modelled is that the evaluation of integer to integer casts are simply bypassed and so the original symbol is used as the new casted symbol (cf SimpleSValBuilder::evalCastFromNonLoc). This lead to the issue described in PR25078, as the RangeConstraintManager associates ranges with symbols. The new evalIntegralCast method added by this patch wont bypass the cast if it finds the range of the symbol to be greater than the maximum value of the target type. The fix to RangeSet::pin mentioned in the initial review will be committed separately. Differential Revision: http://reviews.llvm.org/D12901 llvm-svn: 257464
* AnalysisConsumer: use canonical decl for both lookup and store ofYury Gribov2016-01-111-4/+5
| | | | | | | | | | | | | | | | visited decls. Due to redeclarations, the function may have different declarations used in CallExpr and in the definition. However, we need to use a unique declaration for both store and lookup in VisitedCallees. This patch fixes issues with analysis in topological order. A simple test is included. Patch by Alex Sidorin! Differential Revision: http://reviews.llvm.org/D15410 llvm-svn: 257318
* [analyzer] Fix false warning about memory leak for QApplication::postEventAnna Zaks2016-01-061-0/+10
| | | | | | | | | | | According to Qt documentation Qt takes care of memory allocated for QEvent: http://doc.qt.io/qt-4.8/qcoreapplication.html#postEvent A patch by Evgeniy Dushistov! Differential Revision: http://reviews.llvm.org/D14170 llvm-svn: 256887
* [analyzer] Suppress reports coming from std::__independent_bits_engineAnna Zaks2016-01-061-0/+10
| | | | | | | | | | | | | The analyzer reports a shift by a negative value in the constructor. The bug can be easily triggered by calling std::random_shuffle on a vector (<rdar://problem/19658126>). (The shift by a negative value is reported because __w0_ gets constrained to 63 by the conditions along the path:__w0_ < _WDt && __w0_ >= _WDt-1, where _WDt is 64. In normal execution, __w0_ is not 63, it is 1 and there is no overflow. The path is infeasible, but the analyzer does not know about that.) llvm-svn: 256886
* [analyzer] Don't report null dereferences on address_space annotated memoryAnna Zaks2016-01-061-20/+35
| | | | llvm-svn: 256885
* [analyzer] Handle another Android assert function.Devin Coughlin2015-12-301-0/+1
| | | | | | | | | | | Android's assert can call both the __assert and __assert2 functions under the cover, but the NoReturnFunctionChecker does not handle the latter. This commit fixes that. A patch by Yury Gribov! Differential Revision: http://reviews.llvm.org/D15810 llvm-svn: 256605
* [analyzer] Suppress nullability warning for _Nonnull locals zero-initialized ↵Devin Coughlin2015-12-291-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | by ObjC ARC. Prevent the analyzer from warning when a _Nonnnull local variable is implicitly zero-initialized because of Objective-C automated reference counting. This avoids false positives in cases where a _Nonnull local variable cannot be initialized with an initialization expression, such as: NSString * _Nonnull s; // no-warning @autoreleasepool { s = ...; } The nullability checker will still warn when a _Nonnull local variable is explicitly initialized with nil. This suppression introduces the potential for false negatives if the local variable is used before it is assigned a _Nonnull value. Based on a discussion with Anna Zaks, Jordan Rose, and John McCall, I've added a FIXME to treat implicitly zero-initialized _Nonnull locals as uninitialized in Sema's UninitializedValues analysis to avoid these false negatives. rdar://problem/23522311 llvm-svn: 256603
* [analyzer] Nullability: allow cast to _Nonnull to suppress warning about ↵Devin Coughlin2015-12-291-12/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | returning nil. The nullability checker currently allows casts to suppress warnings when a nil literal is passed as an argument to a parameter annotated as _Nonnull: foo((NSString * _Nonnull)nil); // no-warning It does so by suppressing the diagnostic when the *type* of the argument expression is _Nonnull -- even when the symbolic value returned is known to be nil. This commit updates the nullability checker to similarly honor such casts in the analogous scenario when nil is returned from a function with a _Nonnull return type: return (NSString * _Nonnull)nil; // no-warning This commit also normalizes variable naming between the parameter and return cases and adds several tests demonstrating the limitations of this suppression mechanism (such as when nil is cast to _Nonnull and then stored into a local variable without a nullability qualifier). These tests are marked with FIXMEs. rdar://problem/23176782 llvm-svn: 256567
* Small refactoring in CheckerContext::isCLibraryFunction(). NFC.Devin Coughlin2015-12-281-6/+2
| | | | | | | | | | Use getRedeclContext() instead of a manually-written loop and fix a comment. A patch by Aleksei Sidorin! Differential Revision: http://reviews.llvm.org/D15794 llvm-svn: 256524
* Refactor: Simplify boolean conditional return statements in ↵Alexander Kornienko2015-12-281-4/+1
| | | | | | | | | | | | | | | | lib/StaticAnalyzer/Frontend Summary: Use clang-tidy to simplify boolean conditional return statements Reviewers: dcoughlin, alexfh Subscribers: alexfh, cfe-commits Patch by Richard Thomson! Differential Revision: http://reviews.llvm.org/D10023 llvm-svn: 256497
* Refactor: Simplify boolean conditional return statements in ↵Alexander Kornienko2015-12-2811-70/+29
| | | | | | | | | | | | | | | | lib/StaticAnalyzer/Checkers Summary: Use clang-tidy to simplify boolean conditional return values Reviewers: dcoughlin, krememek Subscribers: krememek, cfe-commits Patch by Richard Thomson! Differential Revision: http://reviews.llvm.org/D10021 llvm-svn: 256491
* [StaticAnalyzer] Use front() and back() instead of dereferencing begin() and ↵Craig Topper2015-12-242-6/+6
| | | | | | rbegin(). Makes the code a little cleaner. NFC llvm-svn: 256358
* [analyzer] Better detect when C++ object was constructed into existing region.Devin Coughlin2015-12-173-38/+101
| | | | | | | | | | | | | | | | | | | | | | | | | When the analyzer evaluates a CXXConstructExpr, it looks ahead in the CFG for the current block to detect what region the object should be constructed into. If the constructor was directly constructed into a local variable or field region then there is no need to explicitly bind the constructed value to the local or field when analyzing the DeclStmt or CXXCtorInitializer that called the constructor. Unfortunately, there were situations in which the CXXConstructExpr was constructed into a temporary region but when evaluating the corresponding DeclStmt or CXXCtorInitializer the analyzer assumed the object was constructed into the local or field. This led to spurious warnings about uninitialized values (PR25777). To avoid these false positives, this commit factors out the logic for determining when a CXXConstructExpr will be directly constructed into existing storage, adds the inverse logic to detect when the corresponding later bind can be safely skipped, and adds assertions to make sure these two checks are in sync. rdar://problem/21947725 llvm-svn: 255859
* [PATCH] Adding checker to detect excess padding in recordsBen Craig2015-12-143-0/+329
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this checker is to generate a report for any class / structure that could reduce its padding by reordering the fields. This results in a very noisy checker. To reduce the noise, this checker will currently only warn when the number of bytes over "optimal" is more than 24. This value is configurable with -analyzer-config performance.Padding:AllowedPad=N. Small values of AllowedPad have the potential to generate hundreds of reports, and gigabytes of HTML reports. The checker searches for padding violations in two main ways. First, it goes record by record. A report is generated if the fields could be reordered in a way that reduces the padding by more than AllowedPad bytes. Second, the checker will generate a report if an array will cause more than AllowedPad padding bytes to be generated. The record checker currently skips many ABI specific cases. Classes with base classes are skipped because base class tail padding is ABI specific. Bitfields are just plain hard, and duplicating that code seems like a bad idea. VLAs are both uncommon and non-trivial to fix. The array checker isn't very thorough right now. It only checks to see if the element type's fields could be reordered, and it doesn't recursively check to see if any of the fields' fields could be reordered. At some point in the future, it would be nice if "arrays" could also look at array new usages and malloc patterns that appear to be creating arrays. llvm-svn: 255545
* Add parse and sema of OpenMP distribute directive with all clauses except ↵Carlo Bertolli2015-12-141-0/+1
| | | | | | dist_schedule llvm-svn: 255498
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-104-7/+62
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* fix typos; NFCSanjay Patel2015-12-091-1/+1
| | | | llvm-svn: 255163
* Reformat linefeeds.NAKAMURA Takumi2015-12-091-4/+1
| | | | llvm-svn: 255098
* Revert r255001, "Add parse and sema for OpenMP distribute directive and all ↵NAKAMURA Takumi2015-12-091-1/+0
| | | | | | | | its clauses excluding dist_schedule." It causes memory leak. Some tests in test/OpenMP would fail. llvm-svn: 255094
* Add parse and sema for OpenMP distribute directive and all its clauses ↵Carlo Bertolli2015-12-081-0/+1
| | | | | | excluding dist_schedule. llvm-svn: 255001
* [analyzer] Fix crash when lambda captures a variable-length array.Devin Coughlin2015-12-071-3/+17
| | | | | | | | | | | | When a C++ lambda captures a variable-length array, it creates a capture field to store the size of the array. The initialization expression for this capture is null, which led the analyzer to crash when initializing the field. To avoid this, use the size expression from the VLA type to determine the initialization value. rdar://problem/23748072 llvm-svn: 254962
* Use llvm::make_range to reduce mentions of iterator type. NFCCraig Topper2015-12-061-2/+1
| | | | llvm-svn: 254870
* [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).Devin Coughlin2015-12-051-12/+13
| | | | | | | | | | This commit prevents MemRegion::getAsOffset() from crashing when the analyzed program casts a symbolic region of a non-record type to some derived type and then attempts to access a field of the base type. rdar://problem/23458069 llvm-svn: 254806
* [analyzer] Improve modelling of nullptr_t in the analyzer. Fix PR25414.Gabor Horvath2015-12-041-0/+17
| | | | | | Differential Revision: http://reviews.llvm.org/D15007 llvm-svn: 254718
* [analyzer] Support inlining lambda-converted blocks.Devin Coughlin2015-12-043-7/+45
| | | | | | | | | clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
* [analyzer] Suppress stack address escape on CK_CopyAndAutoreleaseBlockObject.Devin Coughlin2015-12-031-0/+9
| | | | | | | | | | Don't warn about addresses of stack-allocated blocks escaping if the block region was cast with CK_CopyAndAutoreleaseBlockObject. These casts, which are introduced in the implicit conversion operator for lambda-to-block conversions, cause the block to be copied to the heap -- so the warning is spurious. llvm-svn: 254639
* [OPENMP 4.5] Parsing/sema support for 'omp taskloop simd' directive.Alexey Bataev2015-12-031-0/+1
| | | | | | OpenMP 4.5 adds directive 'taskloop simd'. Patch adds parsing/sema analysis for 'taskloop simd' directive and its clauses. llvm-svn: 254597
* [analyzer] Fix IssueHash generation.Gabor Horvath2015-12-014-12/+15
| | | | | | | | Differential Revision: http://reviews.llvm.org/D14919 Original patch by: Gyorgy Orban! llvm-svn: 254394
* [OPENMP 4.5] Parsing/sema analysis for 'taskloop' directive.Alexey Bataev2015-12-011-0/+1
| | | | | | Adds initial parsing and semantic analysis for 'taskloop' directive. llvm-svn: 254367
* Test commitPierre Gousseau2015-11-261-2/+1
| | | | | | Remove tabs. llvm-svn: 254181
* [MSVC] 'property' with an empty array in array subscript expression.Alexey Bataev2015-11-251-0/+1
| | | | | | | | | | | | MSVC supports 'property' attribute and allows to apply it to the declaration of an empty array in a class or structure definition. For example: ``` __declspec(property(get=GetX, put=PutX)) int x[]; ``` The above statement indicates that x[] can be used with one or more array indices. In this case, i=p->x[a][b] will be turned into i=p->GetX(a, b), and p->x[a][b] = i will be turned into p->PutX(a, b, i); Differential Revision: http://reviews.llvm.org/D13336 llvm-svn: 254067
* [analyzer] Pass value expression for inlined defensive checks when binding ↵Devin Coughlin2015-11-241-1/+30
| | | | | | | | | | | | | | | | null to nonnull. The nullability checker was not suppressing false positives resulting from inlined defensive checks when null was bound to a nonnull variable because it was passing the entire bind statement rather than the value expression to trackNullOrUndefValue(). This commit changes that checker to synactically match on the bind statement to extract the value expression so it can be passed to trackNullOrUndefValue(). rdar://problem/23575439 llvm-svn: 254007
* Remove DataRecursiveASTVisitor; it no longer serves any purpose, since it's ↵Richard Smith2015-11-241-2/+2
| | | | | | just an alias for RecursiveASTVisitor. llvm-svn: 253949
* [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ ↵Devin Coughlin2015-11-201-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | lambdas as escaped. The analyzer currently reports dead store false positives when a local variable is captured by reference in a C++ lambda. For example: int local = 0; auto lambda = [&local]() { local++; }; local = 7; // False Positive: Value stored to 'local' is never read lambda(); In this case, the assignment setting `local` to 7 is not a dead store because the called lambda will later read that assigned value. This commit silences this source of false positives by treating locals captured by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker deals with locals whose address is taken. rdar://problem/22165179 llvm-svn: 253630
* [analyzer] Improve modeling of static initializers.Anna Zaks2015-11-191-4/+10
| | | | | | | | | | | | Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem. The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov! Differential Revision: http://reviews.llvm.org/D14652 llvm-svn: 253532
* [analyzer] Skip checking blocks in dependent contexts.Devin Coughlin2015-11-181-1/+5
| | | | | | | | | | | Since we don't check functions in dependent contexts, we should skip blocks in those contexts as well. This avoids an assertion failure when the DeadStoresChecker attempts to evaluate an array subscript expression with a dependent name type. rdar://problem/23564220 llvm-svn: 253516
* [analyzer] Refer to capture field to determine if capture is reference.Devin Coughlin2015-11-151-5/+5
| | | | | | | | | | | | | The analyzer incorrectly treats captures as references if either the original captured variable is a reference or the variable is captured by reference. This causes the analyzer to crash when capturing a reference type by copy (PR24914). Fix this by refering solely to the capture field to determine when a DeclRefExpr for a lambda capture should be treated as a reference type. https://llvm.org/bugs/show_bug.cgi?id=24914 rdar://problem/23524412 llvm-svn: 253157
* [static analyzer] Don't flag nil storage into NSMutableDictionary.Anna Zaks2015-11-111-2/+1
| | | | | | This is now allowed and has the behavior of removing the mapping. llvm-svn: 252679
* [Analyzer] Fix comments and formatting. NFC.Sean Eveson2015-11-102-4/+4
| | | | llvm-svn: 252599
* [analyzer] Fix assertion failure invalidating on const member function calls ↵Devin Coughlin2015-11-091-1/+3
| | | | | | | | (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
* StaticAnalyzer: Remove implicit ilist iterator conversions, NFCDuncan P. N. Exon Smith2015-11-061-6/+6
| | | | | | Remove implicit ilist iterator conversions from clangStaticAnalyzer. llvm-svn: 252360
OpenPOWER on IntegriCloud