summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Fix unused variable warnings in Release buildsBenjamin Kramer2019-01-121-5/+2
| | | | | | This was just an inlined version of isa<CXXConstructExpr>. NFC. llvm-svn: 351007
* [analyzer] Support for OSObjects out parameters in RetainCountCheckerGeorge Karpenkov2019-01-113-72/+217
| | | | | | | | | rdar://46357478 rdar://47121327 Differential Revision: https://reviews.llvm.org/D56240 llvm-svn: 350982
* [analyzer] Introduce a convenience method for getting a CallEvent from an ↵George Karpenkov2019-01-111-22/+30
| | | | | | | | arbitrary Stmt Differential Revision: https://reviews.llvm.org/D56300 llvm-svn: 350981
* [AST] Remove ASTContext from getThisType (NFC)Brian Gesiak2019-01-113-8/+6
| | | | | | | | | | | | | | | | | | | | | Summary: https://reviews.llvm.org/D54862 removed the usages of `ASTContext&` from within the `CXXMethodDecl::getThisType` method. Remove the parameter altogether, as well as all usages of it. This does not result in any functional change because the parameter was unused since https://reviews.llvm.org/D54862. Test Plan: check-clang Reviewers: akyrtzi, mikael Reviewed By: mikael Subscribers: mehdi_amini, dexonsmith, cfe-commits Differential Revision: https://reviews.llvm.org/D56509 llvm-svn: 350914
* Fix header issues.Richard Trieu2019-01-111-0/+4
| | | | | | | | | | | | | Several headers would fail to compile if other headers were not previously included. The usual issue is that a class is forward declared, but the full definition is needed. The requirement for the definition is use of isa/dyn_cast or calling functions of pointer-packed data types such as DenseMap or PointerIntPair. Add missing includes to these headers. SVals.h required an out-of-line method definition in the .cpp file to avoid circular inclusion of headers with BasicValueFactory.h llvm-svn: 350913
* [analyzer] pr38838, pr39976: Fix crash on diagnosing before implicit destructor.Artem Dergachev2019-01-101-0/+2
| | | | | | | | | | | | | | | | | | | We need to be able to emit the diagnostic at PreImplicitCall, and the patch implements this functionality. However, for now the need for emitting such diagnostics is not all that great: it is only necessary to not crash when emitting a false positive due to an unrelated issue of having dead symbol collection not working properly. Coming up with a non-false-positive test seems impossible with the current set of checkers, though it is likely to be needed for good things as well in the future. Differential Revision: https://reviews.llvm.org/D56042 rdar://problem/46911462 llvm-svn: 350907
* [analyzer] [hotfix] Fix the testsGeorge Karpenkov2019-01-101-5/+7
| | | | | | The error must have crept during the cherry-pick. llvm-svn: 350870
* [analyzer] Update the category name for RetainCountChecker reportsGeorge Karpenkov2019-01-106-67/+65
| | | | | | | | | | ..now that it includes OSObjects rdar://46509986 Differential Revision: https://reviews.llvm.org/D56404 llvm-svn: 350869
* [analyzer] [NFC] [RetainCountChecker] Remove dead unused mapGeorge Karpenkov2019-01-101-6/+0
| | | | | | Differential Revision: https://reviews.llvm.org/D56402 llvm-svn: 350868
* [analyzer] Quote the type of the leaked/problematic object in diagnostics ↵George Karpenkov2019-01-101-8/+9
| | | | | | | | for readability Differential Revision: https://reviews.llvm.org/D56344 llvm-svn: 350867
* [analyzer] [NFC] Reduce redundancy in RetainSummaryManager by using a functionGeorge Karpenkov2019-01-101-20/+8
| | | | | | Differential Revision: https://reviews.llvm.org/D56282 llvm-svn: 350865
* [analyzer] [RetainCountChecker] [NFC] Remove SummaryLogGeorge Karpenkov2019-01-104-103/+46
| | | | | | | | | | | | | | The complicated machinery for passing the summary log around is actually only used for one thing! To figure out whether the "dealloc" message was sent. Since I have tried to extend it for other uses and failed (it's actually very hard to use), I think it's much better to simply use a tag and remove the summary log altogether. Differential Revision: https://reviews.llvm.org/D56228 llvm-svn: 350864
* [analyzer] [RetainCountChecker] [NFC] Another minor cleanupGeorge Karpenkov2019-01-101-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D56224 llvm-svn: 350863
* [analyzer] [RetainCountChecker] [NFC] Refactor the way attributes are handledGeorge Karpenkov2019-01-101-83/+103
| | | | | | | | | | | | | Make sure all checks for attributes go through a centralized function, which checks whether attribute handling is enabled, and performs validation. The type of the attribute is returned. Sadly, metaprogramming is required as attributes have no sensible static getters. Differential Revision: https://reviews.llvm.org/D56222 llvm-svn: 350862
* [analyzer] [RetainCountChecker] Remove redundant enum UnarySummaryKindGeorge Karpenkov2019-01-101-16/+8
| | | | | | Differential Revision: https://reviews.llvm.org/D56072 llvm-svn: 350861
* [analyzer] [RetainCountChecker] Remove obsolete "MakeCollectable" enum valueGeorge Karpenkov2019-01-102-7/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D56071 llvm-svn: 350860
* [analyzer] [RetainCountChecker] [NFC] Remove redundant enum items *Msg, as ↵George Karpenkov2019-01-103-57/+58
| | | | | | | | the object type is already communicated by a separate field Differential Revision: https://reviews.llvm.org/D56070 llvm-svn: 350859
* [analyzer] [NFC] Track object type with ArgEffect in RetainCountChecker.George Karpenkov2019-01-104-105/+122
| | | | | | | | This would be needed in the future. https://reviews.llvm.org/D56040 llvm-svn: 350858
* [analyzer] [NFC] Move ObjKind into a separate top-level enum in ↵George Karpenkov2019-01-104-41/+41
| | | | | | | | | | RetainSummaryManager. Allows using it in future outside of RetEffect. Differential Revision: https://reviews.llvm.org/D56039 llvm-svn: 350857
* Correct the spelling of helpURI to helpUri.Aaron Ballman2019-01-101-1/+1
| | | | | | JSON is case sensitive and the SARIF spec uses the corrected spelling. llvm-svn: 350817
* [analyzer] Pass the correct loc Expr from VisitIncDecOp to evalStoreRafael Stahl2019-01-071-2/+2
| | | | | | | | | | | | | | Summary: The LocationE parameter of evalStore is documented as "The location expression that is stored to". When storing from an increment / decrement operator this was not satisfied. In user code this causes an inconsistency between the SVal and Stmt parameters of checkLocation. Reviewers: NoQ, dcoughlin, george.karpenkov Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Differential Revision: https://reviews.llvm.org/D55701 llvm-svn: 350528
* [analyzer] [NFC] Clean up the mess of constructing argument effects in ↵George Karpenkov2018-12-241-60/+83
| | | | | | | | | | | | | | RetainCountChecker Previously, argument effects were stored in a method variable, which was effectively global. The global state was reset at each (hopefully) entrance point to the summary construction, and every function could modify it. Differential Revision: https://reviews.llvm.org/D56036 llvm-svn: 350057
* [analyzer] pr38668: Do not attempt to cast loaded integers to floats.Artem Dergachev2018-12-222-9/+31
| | | | | | | | | | | | | | | | | | | | | | This patch is a different approach to landing the reverted r349701. It is expected to have the same object (memory region) treated as if it has different types in different program points. The correct behavior for RegionStore when an object is stored as an object of type T1 but loaded as an object of type T2 is to store the object as if it has type T1 but cast it to T2 during load. Note that the cast here is some sort of a "reinterpret_cast" (even in C). For instance, if you store an integer and load a float, you won't get your integer represented as a float; instead, you will get garbage. Admit that we cannot perform the cast and return an unknown value. Differential Revision: https://reviews.llvm.org/D55875 rdar://problem/45062567 llvm-svn: 349984
* Revert "Revert rL349876 from cfe/trunk: [analyzer] Perform escaping in ↵George Karpenkov2018-12-211-23/+28
| | | | | | | | | | RetainCountChecker on type mismatch even for inlined functions" This reverts commit b44b33f6e020a2c369da2b0c1d53cd52975f2526. Revert the revert with the fix. llvm-svn: 349939
* [analyzer] Correct the summary violation diagnostics for the retain count ↵George Karpenkov2018-12-211-1/+1
| | | | | | | | checker It should be in the past tense. llvm-svn: 349938
* Revert rL349876 from cfe/trunk: [analyzer] Perform escaping in ↵Simon Pilgrim2018-12-211-28/+23
| | | | | | | | | | | | | | RetainCountChecker on type mismatch even for inlined functions The fix done in D55465 did not previously apply when the function was inlined. rdar://46889541 Differential Revision: https://reviews.llvm.org/D55976 ........ Fixes broken buildbot: http://lab.llvm.org:8011/builders/llvm-clang-x86_64-expensive-checks-win/builds/14764 llvm-svn: 349894
* [analyzer] Perform escaping in RetainCountChecker on type mismatch even for ↵George Karpenkov2018-12-211-23/+28
| | | | | | | | | | | | inlined functions The fix done in D55465 did not previously apply when the function was inlined. rdar://46889541 Differential Revision: https://reviews.llvm.org/D55976 llvm-svn: 349876
* [analyzer] Fix a bug in RetainCountDiagnostics while printing a note on ↵George Karpenkov2018-12-211-3/+2
| | | | | | | | | | | | mismatched summary in inlined functions Previously, we were not printing a note at all if at least one of the parameters was not annotated. rdar://46888422 Differential Revision: https://reviews.llvm.org/D55972 llvm-svn: 349875
* [analyzer] RetainCount: Suppress retain detection heuristic on some CM methods.Artem Dergachev2018-12-211-0/+11
| | | | | | | | | | | | If it ends with "Retain" like CFRetain and returns a CFTypeRef like CFRetain, then it is not necessarily a CFRetain. But it is indeed true that these two return something retained. Differential Revision: https://reviews.llvm.org/D55907 rdar://problem/39390714 llvm-svn: 349862
* Allow direct navigation to static analysis checker documentation through ↵Aaron Ballman2018-12-203-10/+27
| | | | | | | | SARIF exports. This adds anchors to all of the documented checks so that you can directly link to a check by a stable name. This is useful because the SARIF file format has a field for specifying a URI to documentation for a rule and some viewers, like CodeSonar, make use of this information. These links are then exposed through the SARIF exporter. llvm-svn: 349812
* Revert "[analyzer] pr38668: Do not attempt to cast loaded values..."Artem Dergachev2018-12-201-20/+6
| | | | | | | | | | | | | | | This reverts commit r349701. The patch was incorrect. The whole point of CastRetrievedVal() is to handle the case in which the type from which the cast is made (i.e., the "type" of value `V`) has nothing to do with the type of the region it was loaded from (i.e., `R->getValueType()`). Differential Revision: https://reviews.llvm.org/D55875 rdar://problem/45062567 llvm-svn: 349798
* Replace getOS() == llvm::Triple::*BSD with isOS*BSD() [NFCI]Michal Gorny2018-12-201-4/+4
| | | | | | | | | | | | Replace multiple comparisons of getOS() value with FreeBSD, NetBSD, OpenBSD and DragonFly with matching isOS*BSD() methods. This should improve the consistency of coding style without changing the behavior. Direct getOS() comparisons were left whenever used in switch or switch- like context. Differential Revision: https://reviews.llvm.org/D55916 llvm-svn: 349752
* [analyzer] pr38668: Do not attempt to cast loaded values of non-scalar types.Artem Dergachev2018-12-191-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | It is expected to have the same object (memory region) treated as if it has different types in different program points. The correct behavior for RegionStore when an object is stored as an object of type T1 but loaded as an object of type T2 is to store the object as if it has type T1 but cast it to T2 during load. Note that the cast here is some sort of a "reinterpret_cast" (even in C). For instance, if you store a float and load an integer, you won't have your float rounded to an integer; instead, you will have garbage. Admit that we cannot perform the cast as long as types we're dealing with are non-trivial (neither integers, nor pointers). Of course, if the cast is not necessary (eg, T1 == T2), we can still load the value just fine. Differential Revision: https://reviews.llvm.org/D55875 rdar://problem/45062567 llvm-svn: 349701
* [analyzer] GenericTaint: Fix formatting to prepare for incoming improvements.Artem Dergachev2018-12-191-107/+107
| | | | | | | | Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D54918 llvm-svn: 349698
* [analyzer] Improve modeling for returning an object from the top frame with RVO.Artem Dergachev2018-12-191-8/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Static Analyzer processes the program function-by-function, sometimes diving into other functions ("inlining" them). When an object is returned from an inlined function, Return Value Optimization is modeled, and the returned object is constructed at its return location directly. When an object is returned from the function from which the analysis has started (the top stack frame of the analysis), the return location is unknown. Model it with a SymbolicRegion based on a conjured symbol that is specifically tagged for that purpose, because this is generally the correct way to symbolicate unknown locations in Static Analyzer. Fixes leak false positives when an object is returned from top frame in C++17: objects that are put into a SymbolicRegion-based memory region automatically "escape" and no longer get reported as leaks. This only applies to C++17 return values with destructors, because it produces a redundant CXXBindTemporaryExpr in the call site, which confuses our liveness analysis. The actual fix for liveness analysis is still pending, but it is no longer causing problems. Additionally, re-enable temporary destructor tests in C++17. Differential Revision: https://reviews.llvm.org/D55804 rdar://problem/46217550 llvm-svn: 349696
* [analyzer] CStringChecker: Fix a crash on C++ overloads of standard functions.Artem Dergachev2018-12-191-34/+56
| | | | | | | | | | | | | | | | | | | | | | It turns out that it's not all that uncommon to have a C++ override of, say, memcpy that receives a structure (or two) by reference (or by value, if it's being copied from) and copies memory from it (or into it, if it's passed by reference). In this case the argument will be of structure type (recall that expressions of reference type do not exist: instead, C++ classifies expressions into prvalues and lvalues and xvalues). In this scenario we crash because we are trying to assume that, say, a memory region is equal to an empty CompoundValue (the non-lazy one; this is what makeZeroVal() return for compound types and it represents prvalue of an object that is initialized with an empty initializer list). Add defensive checks. Differential Revision: https://reviews.llvm.org/D55873 rdar://problem/45366551 llvm-svn: 349682
* [analyzer] MoveChecker: Squash the bit field because it causes a GCC warning.Artem Dergachev2018-12-171-5/+3
| | | | | | | | | The warning seems spurious (GCC bug 51242), but the bit field is simply not worth the hassle. rdar://problem/41349073 llvm-svn: 349394
* Revert rC349281 '[analyzer][MallocChecker][NFC] Document and reorganize some ↵Kristof Umann2018-12-171-714/+422
| | | | | | | | | | functions' Accidentally commited earlier with the same commit title, but really it should've been "Revert rC349283 '[analyzer][MallocChecker] Improve warning messages on double-delete errors'" llvm-svn: 349344
* Revert rC349281 '[analyzer][MallocChecker][NFC] Document and reorganize some ↵Kristof Umann2018-12-171-11/+3
| | | | | | functions' llvm-svn: 349340
* Reverting bitfield size to attempt to fix a windows buildbotKristof Umann2018-12-171-1/+1
| | | | llvm-svn: 349336
* [analyzer] MoveChecker: Add an option to suppress warnings on locals.Artem Dergachev2018-12-171-9/+29
| | | | | | | | | | | | | | | | | Re-using a moved-from local variable is most likely a bug because there's rarely a good motivation for not introducing a separate variable instead. We plan to keep emitting such warnings by default. Introduce a flag that allows disabling warnings on local variables that are not of a known move-unsafe type. If it doesn't work out as we expected, we'll just flip the flag. We still warn on move-unsafe objects and unsafe operations on known move-safe objects. Differential Revision: https://reviews.llvm.org/D55730 llvm-svn: 349327
* Speculatively re-apply "[analyzer] MoveChecker: Add checks for dereferencing..."Artem Dergachev2018-12-171-51/+149
| | | | | | | | | | | | This re-applies commit r349226 that was reverted in r349233 due to failures on clang-x64-windows-msvc. Specify enum type as unsigned for use in bit field. Otherwise overflows may cause UB. Differential Revision: https://reviews.llvm.org/D55388 llvm-svn: 349326
* [analyzer] Fix some expressions staying live too long. Add a debug checker.Artem Dergachev2018-12-161-0/+19
| | | | | | | | | | | | | | | | | | | | | StaticAnalyzer uses the CFG-based RelaxedLiveVariables analysis in order to, in particular, figure out values of which expressions are still needed. When the expression becomes "dead", it is garbage-collected during the dead binding scan. Expressions that constitute branches/bodies of control flow statements, eg. `E1' in `if (C1) E1;' but not `E2' in `if (C2) { E2; }', were kept alive for too long. This caused false positives in MoveChecker because it relies on cleaning up loop-local variables when they go out of scope, but some of those live-for-too-long expressions were keeping a reference to those variables. Fix liveness analysis to correctly mark these expressions as dead. Add a debug checker, debug.DumpLiveStmts, in order to test expressions liveness. Differential Revision: https://reviews.llvm.org/D55566 llvm-svn: 349320
* [analyzer][MallocChecker] Improve warning messages on double-delete errorsKristof Umann2018-12-151-2/+10
| | | | | | Differential Revision: https://reviews.llvm.org/D54834 llvm-svn: 349283
* [analyzer][MallocChecker][NFC] Document and reorganize some functionsKristof Umann2018-12-151-422/+714
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch merely reorganizes some things, and features no functional change. In detail: * Provided documentation, or moved existing documentation in more obvious places. * Added dividers. (the //===----------===// thing). * Moved getAllocationFamily, printAllocDeallocName, printExpectedAllocName and printExpectedDeallocName in the global namespace on top of the file where AllocationFamily is declared, as they are very strongly related. * Moved isReleased and MallocUpdateRefState near RefState's definition for the same reason. * Realloc modeling was very poor in terms of variable and structure naming, as well as documentation, so I renamed some of them and added much needed docs. * Moved function IdentifierInfos to a separate struct, and moved isMemFunction, isCMemFunction adn isStandardNewDelete inside it. This makes the patch affect quite a lot of lines, should I extract it to a separate one? * Moved MallocBugVisitor out of MallocChecker. * Preferred switches to long else-if branches in some places. * Neatly organized some RUN: lines. Differential Revision: https://reviews.llvm.org/D54823 llvm-svn: 349281
* [analyzer][NFC] Merge ClangCheckerRegistry to CheckerRegistryKristof Umann2018-12-152-99/+74
| | | | | | | | | | | Now that CheckerRegistry lies in Frontend, we can finally eliminate ClangCheckerRegistry. Fortunately, this also provides us with a DiagnosticsEngine, so I went ahead and removed some parameters from it's methods. Differential Revision: https://reviews.llvm.org/D54437 llvm-svn: 349280
* [analyzer][NFC] Move CheckerRegistry from the Core directory to FrontendKristof Umann2018-12-15102-170/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry &registry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
* [analyzer] Prefer returns values to out-params in CheckerRegistry.cppKristof Umann2018-12-152-95/+53
| | | | | | | | | | | | | | | Renaming collectCheckers to getEnabledCheckers Changing the functionality to acquire all enabled checkers, rather then collect checkers for a specific CheckerOptInfo (for example, collecting all checkers for { "core", true }, which meant enabling all checkers from the core package, which was an unnecessary complication). Removing CheckerOptInfo, instead of storing whether the option was claimed via a field, we handle errors immediately, as getEnabledCheckers can now access a DiagnosticsEngine. Realize that the remaining information it stored is directly accessible through AnalyzerOptions.CheckerControlList. Fix a test with -analyzer-disable-checker -verify accidentally left in. llvm-svn: 349274
* [analyzer] Assume that we always have a SubEngine availableGabor Horvath2018-12-157-49/+36
| | | | | | | | The removed codepath was dead. Differential Revision: https://reviews.llvm.org/D55697 llvm-svn: 349266
* Revert "[analyzer] MoveChecker: Add checks for dereferencing a smart pointer..."Artem Dergachev2018-12-151-149/+51
| | | | | | | | This reverts commit r349226. Fails on an MSVC buildbot. llvm-svn: 349233
OpenPOWER on IntegriCloud