summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Add a statistic for maximum CFG size and a script to summarize ↵Anna Zaks2012-07-051-0/+7
| | | | | | analyzer stats from scan-build output. llvm-svn: 159776
* Drop the ASTContext.h include from Stmt.h and fix up transitive users.Benjamin Kramer2012-07-041-0/+1
| | | | | | | | | | | | | | This required moving the ctors for IntegerLiteral and FloatingLiteral out of line which shouldn't change anything as they are usually called through Create methods that are already out of line. ASTContext::Deallocate has been a nop for a long time, drop it from ASTVector and make it independent from ASTContext.h Pass the StorageAllocator directly to AccessedEntity so it doesn't need to have a definition of ASTContext around. llvm-svn: 159718
* [analyzer] For now, don't inline non-static member overloaded operators.Jordan Rose2012-07-033-8/+51
| | | | | | | | | | | | | | Our current inlining support (specifically RegionStore::enterStackFrame) doesn't know that calls to overloaded operators may be calls to non-static member functions, and that in these cases the first argument should be treated as 'this'. This caused incorrect results and sometimes crashes. The long-term fix will be to rewrite RegionStore::enterStackFrame to use CallEvent and its subclasses, but for now we can just disable these problematic calls by classifying them under a new CallEvent, CXXMemberOperatorCall. llvm-svn: 159692
* [analyzer] Introduce CXXAllocatorCall to handle placement arg invalidation.Jordan Rose2012-07-023-165/+28
| | | | | | | This is NOT full-blown support for operator new, but removes some nasty duplicated code introduced in r158784. llvm-svn: 159608
* [analyzer] If 'super' is known to be nil, we can still mark its range.Jordan Rose2012-07-021-1/+1
| | | | llvm-svn: 159596
* Revert "Remove unused member (& consequently unused parameter) in SA's Call ↵Jordan Rose2012-07-021-2/+3
| | | | | | | | | | | | | code." ...and instead add an accessor. We're not using this today, but it's something that should probably stay in the source for potential clients, and it doesn't cost a lot. (ObjCPropertyAccess is only created on the stack, and right now there's only ever one alive at a time.) This reverts r159581 / commit 8e674e1da34a131faa7d43dc3fcbd6e49120edbe. llvm-svn: 159595
* Remove unused member (& consequently unused parameter) in SA's Call code.David Blaikie2012-07-021-3/+2
| | | | | | This member became unused in r159559. llvm-svn: 159581
* Bail out the LiveVariables analysis when the CFG is very large, asTed Kremenek2012-07-022-0/+10
| | | | | | | | | we are encountering some scalability issues with memory usage. The appropriate long term fix is to make the analysis more scalable, but this will at least prevent the analyzer swapping when analyzing very large functions. llvm-svn: 159578
* Fix subtle bug in AnalysisConsumer where we would not analyze functions ↵Ted Kremenek2012-07-021-7/+9
| | | | | | | | | | | | whose parent in the call graph had been inlined but for whatever reason we did not inline some of its callees. Also, fix a related traversal bug where we meant to do a BFS of the callgraph but instead were doing a DFS. llvm-svn: 159577
* [analyzer] Convert existing checkers to use check::preCall and check::postCall.Jordan Rose2012-07-024-201/+101
| | | | llvm-svn: 159563
* [analyzer] Add generic preCall and postCall checks.Jordan Rose2012-07-025-14/+126
| | | | llvm-svn: 159562
* [analyzer] Convert CXXConstructExpr over to use CallEvent for evaluation.Jordan Rose2012-07-021-83/+13
| | | | llvm-svn: 159561
* [analyzer] Use CallEvent for inlining and call default-evaluation.Jordan Rose2012-07-023-131/+122
| | | | llvm-svn: 159560
* [analyzer] Finish replacing ObjCMessage with ObjCMethodDecl and friends.Jordan Rose2012-07-0213-160/+124
| | | | | | | | The preObjCMessage and postObjCMessage callbacks now take an ObjCMethodCall argument, which can represent an explicit message send (ObjCMessageSend) or an implicit message generated by a property access (ObjCPropertyAccess). llvm-svn: 159559
* [analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends.Jordan Rose2012-07-027-52/+63
| | | | | | | | | | | | Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper around the existing ObjCMessage abstraction (over message sends and property accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses ObjCMessageSend and ObjCPropertyAccess. In addition to removing yet another wrapper object, this should make it easy to add a ObjCSubscriptAccess call event soon. llvm-svn: 159558
* [analyzer] Move the last bits of CallOrObjCMessage over to CallEvent.Jordan Rose2012-07-026-249/+89
| | | | | | | | | | | | | This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
* [analyzer] Convert CallAndMessageChecker and ObjCSelfInitChecker to CallEvent.Jordan Rose2012-07-022-24/+68
| | | | | | | | | Both of these got uglier rather than cleaner because we don't have preCall and postCall yet; properly wrapping a CallExpr in a CallEvent requires doing a bit of deconstruction on the callee. Even when we have preCall and postCall we may want to expose the current CallEvent to pre/postStmt<CallExpr>. llvm-svn: 159556
* [analyzer] Convert RetainCountChecker to use CallEvent as much as possible.Jordan Rose2012-07-021-188/+237
| | | | | | | | | | | | | | | | | | | | | | | | | This ended allowing quite a bit of cleanup, and some minor changes. - CallEvent makes it easy to use hasNonZeroCallbackArg more aggressively, which we check in order to avoid false positives with callbacks that might release the object. - In order to support this for functions which consume their arguments, there are two new ArgEffects: DecRefAndStopTracking and DecRefMsgAndStopTracking. These act just like StopTracking, except that if the object only had a return count of +1 it's now considered released instead (so we still get use-after-free messages). - On the plus side, we no longer have to special-case +[NSObject performSelector:withObject:afterDelay:] and friends. - The use of IdentifierInfos in the method summary cache is now hidden; only the ObjCInterfaceDecl gets passed around most of the time. - Since we cache all "simple" summaries and check every function call, there is no real benefit to having NULL stand in for default summaries anymore. - Whitespace, unused methods, etc. Even more simplification to come when we get check::postCall and can unify all these other post* checks. llvm-svn: 159555
* [analyzer] Add a new abstraction over all types of calls: CallEventJordan Rose2012-07-0213-325/+510
| | | | | | | | | | This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
* Revert "Tweak insecureAPI analyzer checks to have the ability to be ↵Ted Kremenek2012-06-291-2/+8
| | | | | | | | individually disabled." Jordan Rose corrected me that this actually isn't needed. llvm-svn: 159462
* Tweak insecureAPI analyzer checks to have the ability to be individually ↵Ted Kremenek2012-06-291-8/+2
| | | | | | | | | | | | disabled. The solution is a bit inefficient: it creates N checkers, one for each check, and each check does a dispatch on the function name. This is redundant, but we can fix this once we have the proper ability to enable/disable subchecks. Fixes <rdar://problem/11780180>. llvm-svn: 159459
* [analyzer] Add a test that we are, in fact, doing a DFS on the ExplodedGraph.Jordan Rose2012-06-294-1/+63
| | | | | | | | | | | | | | | | | | | | Previously: ...the comment said DFS... ...the WorkList being instantiated said BFS... ...and the implementation was actually DFS... ...due to an unintentional change in 2010... ...and everything kept working anyway. This fixes our std::deque implementation of BFS, but switches back to a SmallVector-based implementation of DFS. We should probably still investigate the ramifications of DFS vs. BFS, especially for large functions (and especially when we hit our block path limit), since this might completely change our memory use. It can also mask some bugs and reveal others depending on when we halt analysis. But at least we will not have this kind of little mistake creep in again. llvm-svn: 159397
* [analyzer] RetainCountChecker: remove unused SelfOwn ArgEffect kind.Jordan Rose2012-06-271-4/+1
| | | | llvm-svn: 159245
* [analyzer] Remove unneeded helper function (it's in ASTContext.h)Jordan Rose2012-06-271-9/+0
| | | | llvm-svn: 159244
* [analyzer] Be careful about implicitly-declared operator new/delete. (PR13090)Jordan Rose2012-06-251-2/+1
| | | | | | | | The implicit global allocation functions do not have valid source locations, but we still want to treat them as being "system header" functions for the purposes of how they affect program state. llvm-svn: 159160
* Implement initial static analysis inlining support for C++ methods.Ted Kremenek2012-06-225-50/+68
| | | | llvm-svn: 159047
* [analyzer] Teach malloc checker that initWith[Bytes|Characters}NoCopy Anna Zaks2012-06-221-1/+3
| | | | | | relinquish memory. llvm-svn: 159043
* [analyzer] Remove a statistic - it's too expensive.Anna Zaks2012-06-221-6/+0
| | | | | | (Committed in r159038 by mistake.) llvm-svn: 159040
* [analyzer]scan-build: report the total number of steps analyzer performsAnna Zaks2012-06-221-0/+7
| | | | | | This would be useful to investigate performance issues. llvm-svn: 159038
* [analyzer] Fixup to r158958.Anna Zaks2012-06-221-2/+2
| | | | llvm-svn: 159037
* [analyzer] Report the cumulative number of steps the analyzer performs.Anna Zaks2012-06-221-0/+4
| | | | llvm-svn: 159036
* [analyzer] Check for +raise:format: on subclasses of NSException as well.Jordan Rose2012-06-221-36/+47
| | | | | | | | | | | We don't handle exceptions yet, so we treat them as sinks. ExprEngine hardcodes messages that are known to raise Objective-C exceptions like -raise, but it was only checking for +raise:format: and +raise:format:arguments: on NSException itself, not subclasses. <rdar://problem/11724201> llvm-svn: 159010
* [analyzer] Malloc: Warn about use-after-free when memory ownership wasAnna Zaks2012-06-221-11/+73
| | | | | | transfered with dataWithBytesNoCopy. llvm-svn: 158958
* Remove a goofy CMake hack and use the standard CMake facilities toChandler Carruth2012-06-213-9/+29
| | | | | | | | | express library-level dependencies within Clang. This is no more verbose really, and plays nicer with the rest of the CMake facilities. It should also have no change in functionality. llvm-svn: 158888
* [analyzer] Malloc leak false positive: Allow xpc context to escape.Anna Zaks2012-06-201-0/+6
| | | | llvm-svn: 158875
* [analyzer] Malloc: cleanup, disallow free on relinquished memory.Anna Zaks2012-06-201-10/+17
| | | | | | | | This commits sets the grounds for more aggressive use after free checking. We will use the Relinquished sate to denote that someone else is now responsible for releasing the memory. llvm-svn: 158850
* [analyzer] Invalidate placement args; return the pointer given to placement newJordan Rose2012-06-201-4/+104
| | | | | | | | | | | | | | | | | | | | | | | | | The default global placement new just returns the pointer it is given. Note that other custom 'new' implementations with placement args are not guaranteed to do this. In addition, we need to invalidate placement args, since they may be updated by the allocator function. (Also, right now we don't properly handle the constructor inside a CXXNewExpr, so we need to invalidate the placement args just so that callers know something changed!) This invalidation is not perfect because CallOrObjCMessage doesn't support CXXNewExpr, and all of our invalidation callbacks expect that if there's no CallOrObjCMessage, the invalidation is happening manually (e.g. by a direct assignment) and shouldn't affect checker-specific metadata (like malloc state); hence the malloc test case in new-fail.cpp. But region values are now properly invalidated, at least. The long-term solution to this problem is to rework CallOrObjCMessage into something more general, rather than the morass of branches it is today. <rdar://problem/11679031> llvm-svn: 158784
* [analyzer] Allow pointers to escape into NSPointerArray.Anna Zaks2012-06-191-0/+10
| | | | | | (Fixes radar://11691035 PR13140) llvm-svn: 158703
* [analyzer] Add a comment: why we treat array compound literals as lvalues.Jordan Rose2012-06-181-1/+9
| | | | llvm-svn: 158681
* [analyzer] Array CompoundLiteralExprs need to be treated like lvalues.Jordan Rose2012-06-161-1/+1
| | | | llvm-svn: 158588
* [analyzer] Return an UnknownVal when we try to get the binding for a VLA.Jordan Rose2012-06-161-2/+6
| | | | | | | | | This happens in C++ mode right at the declaration of a struct VLA; MallocChecker sees a bind and tries to get see if it's an escaping bind. It's likely that our handling of this is still incomplete, but it fixes a crash on valid without disturbing anything else for now. llvm-svn: 158587
* [analyzer] Buffers passed to CGBitmapContextCreate can escape.Jordan Rose2012-06-161-5/+7
| | | | | | | | | | | | | | Specifically, although the bitmap context does not take ownership of the buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted out of the created CGContextRef. Thus the buffer is not leaked even if its original pointer goes out of scope, as long as - the context escapes, or - it is retrieved via CGBitmapContextGetData and freed. Actually implementing that logic is beyond the current scope of MallocChecker, so for now CGBitmapContextCreate goes on our system function exception list. llvm-svn: 158579
* Documentation cleanup: fix a type, LocatioinE -> LocationEJames Dennett2012-06-151-2/+2
| | | | llvm-svn: 158566
* [analyzer] RetainCount: don't track objects init'd with a delegateJordan Rose2012-06-151-4/+9
| | | | | | | | | We already didn't track objects that have delegates or callbacks or objects that are passed through void * "context pointers". It's a not-uncommon pattern to release the object in its callback, and so the leak message we give is not very helpful. llvm-svn: 158532
* Documentation cleanup:James Dennett2012-06-151-10/+12
| | | | | | | | | * Add \brief to produce a summary in the Doxygen output; * Add missing parameter names to \param commands; * Fix mismatched parameter names for \param commands; * Add a parameter name so that the \param has a target. llvm-svn: 158503
* Revert "[analyzer] Treat LValueBitCasts like regular pointer bit casts."Jordan Rose2012-06-123-12/+7
| | | | | | | | | This does not actually give us the right behavior for reinterpret_cast of references. Reverting so I can think about it some more. This reverts commit 50a75a6e26a49011150067adac556ef978639fe6. llvm-svn: 158341
* [analyzer] Treat LValueBitCasts like regular pointer bit casts.Jordan Rose2012-06-113-7/+12
| | | | | | | | | | | | | These casts only appear in very well-defined circumstances, in which the target of a reinterpret_cast or a function formal parameter is an lvalue reference. According to the C++ standard, the following are equivalent: reinterpret_cast<T&>( x) *reinterpret_cast<T*>(&x) [expr.reinterpret.cast]p11 llvm-svn: 158338
* Etch out the code path for MS-style inline assembly.Chad Rosier2012-06-111-0/+12
| | | | llvm-svn: 158325
* [analyzer] Add ObjCLoopChecker: objects from NSArray et al are non-nil.Jordan Rose2012-06-113-4/+86
| | | | | | | | | | | | While collections containing nil elements can still be iterated over in an Objective-C for-in loop, the most common Cocoa collections -- NSArray, NSDictionary, and NSSet -- cannot contain nil elements. This checker adds that assumption to the analyzer state. This was the cause of some minor false positives concerning CFRelease calls on objects in an NSArray. llvm-svn: 158319
* [analyzer] When looking for a known class, only traverse the hierarchy once.Jordan Rose2012-06-111-48/+50
| | | | | | | | | This has a small hit in the case where only one class is interesting (NilArgChecker) but is a big improvement when looking for one of several interesting classes (VariadicMethodTypeChecker), in which the most common case is that there is no match. llvm-svn: 158318
OpenPOWER on IntegriCloud