summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [PATCH] Adding checker to detect excess padding in recordsBen Craig2015-12-143-0/+329
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this checker is to generate a report for any class / structure that could reduce its padding by reordering the fields. This results in a very noisy checker. To reduce the noise, this checker will currently only warn when the number of bytes over "optimal" is more than 24. This value is configurable with -analyzer-config performance.Padding:AllowedPad=N. Small values of AllowedPad have the potential to generate hundreds of reports, and gigabytes of HTML reports. The checker searches for padding violations in two main ways. First, it goes record by record. A report is generated if the fields could be reordered in a way that reduces the padding by more than AllowedPad bytes. Second, the checker will generate a report if an array will cause more than AllowedPad padding bytes to be generated. The record checker currently skips many ABI specific cases. Classes with base classes are skipped because base class tail padding is ABI specific. Bitfields are just plain hard, and duplicating that code seems like a bad idea. VLAs are both uncommon and non-trivial to fix. The array checker isn't very thorough right now. It only checks to see if the element type's fields could be reordered, and it doesn't recursively check to see if any of the fields' fields could be reordered. At some point in the future, it would be nice if "arrays" could also look at array new usages and malloc patterns that appear to be creating arrays. llvm-svn: 255545
* Add parse and sema of OpenMP distribute directive with all clauses except ↵Carlo Bertolli2015-12-141-0/+1
| | | | | | dist_schedule llvm-svn: 255498
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-104-7/+62
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* fix typos; NFCSanjay Patel2015-12-091-1/+1
| | | | llvm-svn: 255163
* Reformat linefeeds.NAKAMURA Takumi2015-12-091-4/+1
| | | | llvm-svn: 255098
* Revert r255001, "Add parse and sema for OpenMP distribute directive and all ↵NAKAMURA Takumi2015-12-091-1/+0
| | | | | | | | its clauses excluding dist_schedule." It causes memory leak. Some tests in test/OpenMP would fail. llvm-svn: 255094
* Add parse and sema for OpenMP distribute directive and all its clauses ↵Carlo Bertolli2015-12-081-0/+1
| | | | | | excluding dist_schedule. llvm-svn: 255001
* [analyzer] Fix crash when lambda captures a variable-length array.Devin Coughlin2015-12-071-3/+17
| | | | | | | | | | | | When a C++ lambda captures a variable-length array, it creates a capture field to store the size of the array. The initialization expression for this capture is null, which led the analyzer to crash when initializing the field. To avoid this, use the size expression from the VLA type to determine the initialization value. rdar://problem/23748072 llvm-svn: 254962
* Use llvm::make_range to reduce mentions of iterator type. NFCCraig Topper2015-12-061-2/+1
| | | | llvm-svn: 254870
* [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).Devin Coughlin2015-12-051-12/+13
| | | | | | | | | | This commit prevents MemRegion::getAsOffset() from crashing when the analyzed program casts a symbolic region of a non-record type to some derived type and then attempts to access a field of the base type. rdar://problem/23458069 llvm-svn: 254806
* [analyzer] Improve modelling of nullptr_t in the analyzer. Fix PR25414.Gabor Horvath2015-12-041-0/+17
| | | | | | Differential Revision: http://reviews.llvm.org/D15007 llvm-svn: 254718
* [analyzer] Support inlining lambda-converted blocks.Devin Coughlin2015-12-043-7/+45
| | | | | | | | | clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
* [analyzer] Suppress stack address escape on CK_CopyAndAutoreleaseBlockObject.Devin Coughlin2015-12-031-0/+9
| | | | | | | | | | Don't warn about addresses of stack-allocated blocks escaping if the block region was cast with CK_CopyAndAutoreleaseBlockObject. These casts, which are introduced in the implicit conversion operator for lambda-to-block conversions, cause the block to be copied to the heap -- so the warning is spurious. llvm-svn: 254639
* [OPENMP 4.5] Parsing/sema support for 'omp taskloop simd' directive.Alexey Bataev2015-12-031-0/+1
| | | | | | OpenMP 4.5 adds directive 'taskloop simd'. Patch adds parsing/sema analysis for 'taskloop simd' directive and its clauses. llvm-svn: 254597
* [analyzer] Fix IssueHash generation.Gabor Horvath2015-12-014-12/+15
| | | | | | | | Differential Revision: http://reviews.llvm.org/D14919 Original patch by: Gyorgy Orban! llvm-svn: 254394
* [OPENMP 4.5] Parsing/sema analysis for 'taskloop' directive.Alexey Bataev2015-12-011-0/+1
| | | | | | Adds initial parsing and semantic analysis for 'taskloop' directive. llvm-svn: 254367
* Test commitPierre Gousseau2015-11-261-2/+1
| | | | | | Remove tabs. llvm-svn: 254181
* [MSVC] 'property' with an empty array in array subscript expression.Alexey Bataev2015-11-251-0/+1
| | | | | | | | | | | | MSVC supports 'property' attribute and allows to apply it to the declaration of an empty array in a class or structure definition. For example: ``` __declspec(property(get=GetX, put=PutX)) int x[]; ``` The above statement indicates that x[] can be used with one or more array indices. In this case, i=p->x[a][b] will be turned into i=p->GetX(a, b), and p->x[a][b] = i will be turned into p->PutX(a, b, i); Differential Revision: http://reviews.llvm.org/D13336 llvm-svn: 254067
* [analyzer] Pass value expression for inlined defensive checks when binding ↵Devin Coughlin2015-11-241-1/+30
| | | | | | | | | | | | | | | | null to nonnull. The nullability checker was not suppressing false positives resulting from inlined defensive checks when null was bound to a nonnull variable because it was passing the entire bind statement rather than the value expression to trackNullOrUndefValue(). This commit changes that checker to synactically match on the bind statement to extract the value expression so it can be passed to trackNullOrUndefValue(). rdar://problem/23575439 llvm-svn: 254007
* Remove DataRecursiveASTVisitor; it no longer serves any purpose, since it's ↵Richard Smith2015-11-241-2/+2
| | | | | | just an alias for RecursiveASTVisitor. llvm-svn: 253949
* [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ ↵Devin Coughlin2015-11-201-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | lambdas as escaped. The analyzer currently reports dead store false positives when a local variable is captured by reference in a C++ lambda. For example: int local = 0; auto lambda = [&local]() { local++; }; local = 7; // False Positive: Value stored to 'local' is never read lambda(); In this case, the assignment setting `local` to 7 is not a dead store because the called lambda will later read that assigned value. This commit silences this source of false positives by treating locals captured by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker deals with locals whose address is taken. rdar://problem/22165179 llvm-svn: 253630
* [analyzer] Improve modeling of static initializers.Anna Zaks2015-11-191-4/+10
| | | | | | | | | | | | Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem. The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov! Differential Revision: http://reviews.llvm.org/D14652 llvm-svn: 253532
* [analyzer] Skip checking blocks in dependent contexts.Devin Coughlin2015-11-181-1/+5
| | | | | | | | | | | Since we don't check functions in dependent contexts, we should skip blocks in those contexts as well. This avoids an assertion failure when the DeadStoresChecker attempts to evaluate an array subscript expression with a dependent name type. rdar://problem/23564220 llvm-svn: 253516
* [analyzer] Refer to capture field to determine if capture is reference.Devin Coughlin2015-11-151-5/+5
| | | | | | | | | | | | | The analyzer incorrectly treats captures as references if either the original captured variable is a reference or the variable is captured by reference. This causes the analyzer to crash when capturing a reference type by copy (PR24914). Fix this by refering solely to the capture field to determine when a DeclRefExpr for a lambda capture should be treated as a reference type. https://llvm.org/bugs/show_bug.cgi?id=24914 rdar://problem/23524412 llvm-svn: 253157
* [static analyzer] Don't flag nil storage into NSMutableDictionary.Anna Zaks2015-11-111-2/+1
| | | | | | This is now allowed and has the behavior of removing the mapping. llvm-svn: 252679
* [Analyzer] Fix comments and formatting. NFC.Sean Eveson2015-11-102-4/+4
| | | | llvm-svn: 252599
* [analyzer] Fix assertion failure invalidating on const member function calls ↵Devin Coughlin2015-11-091-1/+3
| | | | | | | | (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
* StaticAnalyzer: Remove implicit ilist iterator conversions, NFCDuncan P. N. Exon Smith2015-11-061-6/+6
| | | | | | Remove implicit ilist iterator conversions from clangStaticAnalyzer. llvm-svn: 252360
* [analyzer] Add VforkChecker to find unsafe code in vforked process.Yury Gribov2015-11-065-9/+253
| | | | | | | | | | | | This checker looks for unsafe constructs in vforked process: function calls (excluding whitelist), memory write and returns. This was originally motivated by a vfork-related bug in xtables package. Patch by Yury Gribov. Differential revision: http://reviews.llvm.org/D14014 llvm-svn: 252285
* [analyzer] Update RegionStoreManager::getBinding to handle BlockDataRegionsDevin Coughlin2015-11-051-0/+4
| | | | | | | | | | | | Update RegionStoreManager::getBinding() to return UnknownVal when trying to get the binding for a BlockDataRegion. Previously, getBinding() would try to cast the BlockDataRegion to a TypedValueRegion and crash. This happened when a block was passed as a parameter to an inlined function for which StackHintGeneratorForSymbol::getMessage() tried to generate a stack hint message. rdar://problem/21291971 llvm-svn: 252185
* Fix some Clang-tidy modernize warnings, other minor fixes.Eugene Zelenko2015-11-042-4/+4
| | | | | | Differential revision: http://reviews.llvm.org/D14311 llvm-svn: 252081
* [analyzer] Add 'optin' checker package and move localizability checkers into it.Devin Coughlin2015-11-042-13/+44
| | | | | | | | | | | | | | | | | | | | | | This commit creates a new 'optin' top-level checker package and moves several of the localizability checkers into it. This package is for checkers that are not alpha and that would normally be on by default but where the driver does not have enough information to determine when they are applicable. The localizability checkers fit this criterion because the driver cannot determine whether a project is localized or not -- this is best determined at the IDE or build-system level. This new package is *not* intended for checkers that are too noisy to be on by default. The hierarchy under 'optin' mirrors that in 'alpha': checkers under 'optin' should be organized in the hierarchy they would have had if they were truly top level (e.g., optin.osx.cocoa.MyOptInChecker). Differential Revision: http://reviews.llvm.org/D14303 llvm-svn: 252080
* [analyzer] Move the ObjCGenericsChecker out of the alpha package.Devin Coughlin2015-11-031-4/+4
| | | | | | | It is now in the osx.cocoa package and so will be on by default for Apple toolchains. llvm-svn: 251966
* Support watchOS and tvOS driver optionsTim Northover2015-10-301-1/+2
| | | | | | | | This patch should add support for almost all command-line options and driver tinkering necessary to produce a correct "clang -cc1" invocation for watchOS and tvOS. llvm-svn: 251706
* Reapply r251621 "[Analyzer] Widening loops which do not exit"Sean Eveson2015-10-304-1/+94
| | | | | | It was not the cause of the build bot failure. llvm-svn: 251702
* Revert r251621 "[Analyzer] Widening loops which do not exit" (bot failure)Sean Eveson2015-10-304-94/+1
| | | | | | | | Seems to be causing clang-cmake-mips build bot to fail (timeout) http://lab.llvm.org:8011/builders/clang-cmake-mips/builds/10299 llvm-svn: 251697
* [Analyzer] Widening loops which do not exitSean Eveson2015-10-294-1/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Dear All, We have been looking at the following problem, where any code after the constant bound loop is not analyzed because of the limit on how many times the same block is visited, as described in bugzillas #7638 and #23438. This problem is of interest to us because we have identified significant bugs that the checkers are not locating. We have been discussing a solution involving ranges as a longer term project, but I would like to propose a patch to improve the current implementation. Example issue: ``` for (int i = 0; i < 1000; ++i) {...something...} int *p = 0; *p = 0xDEADBEEF; ``` The proposal is to go through the first and last iterations of the loop. The patch creates an exploded node for the approximate last iteration of constant bound loops, before the max loop limit / block visit limit is reached. It does this by identifying the variable in the loop condition and finding the value which is “one away” from the loop being false. For example, if the condition is (x < 10), then an exploded node is created where the value of x is 9. Evaluating the loop body with x = 9 will then result in the analysis continuing after the loop, providing x is incremented. The patch passes all the tests, with some modifications to coverage.c, in order to make the ‘function_which_gives_up’ continue to give up, since the changes allowed the analysis to progress past the loop. This patch does introduce possible false positives, as a result of not knowing the state of variables which might be modified in the loop. I believe that, as a user, I would rather have false positives after loops than do no analysis at all. I understand this may not be the common opinion and am interested in hearing your views. There are also issues regarding break statements, which are not considered. A more advanced implementation of this approach might be able to consider other conditions in the loop, which would allow paths leading to breaks to be analyzed. Lastly, I have performed a study on large code bases and I think there is little benefit in having “max-loop” default to 4 with the patch. For variable bound loops this tends to result in duplicated analysis after the loop, and it makes little difference to any constant bound loop which will do more than a few iterations. It might be beneficial to lower the default to 2, especially for the shallow analysis setting. Please let me know your opinions on this approach to processing constant bound loops and the patch itself. Regards, Sean Eveson SN Systems - Sony Computer Entertainment Group Reviewers: jordan_rose, krememek, xazax.hun, zaks.anna, dcoughlin Subscribers: krememek, xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D12358 llvm-svn: 251621
* Put global classes into the appropriate namespace.Benjamin Kramer2015-10-281-0/+2
| | | | | | | Most of the cases belong into an anonymous namespace. No functionality change intended. llvm-svn: 251514
* [analyzer] Assume escape is possible through system functions taking void*Anna Zaks2015-10-272-13/+30
| | | | | | | | | | | | | | | | | | The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
* [analyzer] Fix lambdas that are capturing constants.Gabor Horvath2015-10-271-7/+14
| | | | llvm-svn: 251407
* [analyzer] Fix another crash when analyzing lambda functions.Gabor Horvath2015-10-271-1/+2
| | | | llvm-svn: 251404
* [coroutines] Creation of promise object, lookup of operator co_await, buildingRichard Smith2015-10-271-0/+4
| | | | | | of await_* calls, and AST representation for same. llvm-svn: 251387
* [analyzer] Fixed a rare crash when analyzing lambda functions.Gabor Horvath2015-10-261-1/+1
| | | | llvm-svn: 251289
* [StaticAnalyzer] Use llvm::utostr and not to_string.Davide Italiano2015-10-231-1/+2
| | | | | | | The latter seems unsupported (at least) on MinGW and FreeBSD (where I hit this failure). We can't have nice things. llvm-svn: 251115
* Attempt to fix build bot test failures.Gabor Horvath2015-10-221-1/+1
| | | | llvm-svn: 251014
* [analyzer] Bug identificationGabor Horvath2015-10-226-10/+262
| | | | | | | | | | | | | | | | This patch adds hashes to the plist and html output to be able to identfy bugs for suppressing false positives or diff results against a baseline. This hash aims to be resilient for code evolution and is usable to identify bugs in two different snapshots of the same software. One missing piece however is a permanent unique identifier of the checker that produces the warning. Once that issue is resolved, the hashes generated are going to change. Until that point this feature is marked experimental, but it is suitable for early adoption. Differential Revision: http://reviews.llvm.org/D10305 Original patch by: Bence Babati! llvm-svn: 251011
* Roll-back r250822.Angel Garcia Gomez2015-10-2012-26/+27
| | | | | | | | | | Summary: It breaks the build for the ASTMatchers Subscribers: klimek, cfe-commits Differential Revision: http://reviews.llvm.org/D13893 llvm-svn: 250827
* Apply modernize-use-default to clang.Angel Garcia Gomez2015-10-2012-27/+26
| | | | | | | | | | | | Summary: Replace empty bodies of default constructors and destructors with '= default'. Reviewers: bkramer, klimek Subscribers: klimek, alexfh, cfe-commits Differential Revision: http://reviews.llvm.org/D13890 llvm-svn: 250822
* Test commitSean Eveson2015-10-161-1/+1
| | | | llvm-svn: 250500
* [analyzer] Don’t invalidate CXXThis when conservatively evaluating const ↵Devin Coughlin2015-10-131-6/+29
| | | | | | | | | | | | methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
OpenPOWER on IntegriCloud