summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [clang] Update uses of DEBUG macro to LLVM_DEBUG.Nicola Zaghen2018-05-152-6/+6
| | | | | | | | | | | | | The DEBUG() macro is very generic so it might clash with other projects. The renaming was done as follows: - git grep -l 'DEBUG' | xargs sed -i 's/\bDEBUG\s\?(/LLVM_DEBUG(/g' - git diff -U0 master | ../clang/tools/clang-format/clang-format-diff.py -i -p1 -style LLVM Explicitly avoided changing the strings in the clang-format tests. Differential Revision: https://reviews.llvm.org/D44975 llvm-svn: 332350
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-54/+97
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Extend the ObjCAutoreleaseWriteChecker to warn on captures as wellGeorge Karpenkov2018-05-141-29/+51
| | | | | | | | | | A common pattern is that the code in the block does not write into the variable explicitly, but instead passes it to a helper function which performs the write. Differential Revision: https://reviews.llvm.org/D46772 llvm-svn: 332300
* [analyzer] Ignore the nullability quantifiers for autoreleasewritecheckerGeorge Karpenkov2018-05-111-2/+2
| | | | llvm-svn: 332136
* Fixes issue introduced by r331556.Alexander Kornienko2018-05-091-3/+5
| | | | | | | | | | Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357 Patch by Rafael Stahl! Differential revision: https://reviews.llvm.org/D46633 llvm-svn: 331870
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-0920-86/+86
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* Fix a couple places that immediately called operator-> on the result of ↵Craig Topper2018-05-051-1/+1
| | | | | | | | dyn_cast. It looks like it safe to just use cast for both cases. llvm-svn: 331578
* [analyzer] Remove untested code in evalLoad.Artem Dergachev2018-05-041-37/+0
| | | | | | No functional change intended. llvm-svn: 331565
* [analyzer] Invalidate union regions properly. Don't hesitate to load later.Artem Dergachev2018-05-041-6/+1
| | | | | | | | | | | | | | | | | | | We weren't invalidating our unions correctly. The previous behavior in invalidateRegionsWorker::VisitCluster() was to direct-bind an UnknownVal to the union (at offset 0). For that reason we were never actually loading default bindings from our unions, because there never was any default binding to load, and the value that is presumed when there's no default binding to load is usually completely incorrect (eg. UndefinedVal for stack unions). The new behavior is to default-bind a conjured symbol (of irrelevant type) to the union that's being invalidated, similarly to what we do for structures and classes. Then it becomes safe to load the value properly. Differential Revision: https://reviews.llvm.org/D45241 llvm-svn: 331563
* [analyzer] pr36458: Fix retrieved value cast for symbolic void pointers.Artem Dergachev2018-05-041-0/+14
| | | | | | | | | | | | | C allows us to write any bytes into any memory region. When loading weird bytes from memory regions of known types, the analyzer is required to make sure that the loaded value makes sense by casting it to an appropriate type. Fix such cast for loading values that represent void pointers from non-void pointer type places. Differential Revision: https://reviews.llvm.org/D46415 llvm-svn: 331562
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-046-35/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] pr37209: Fix casts of glvalues to references.Artem Dergachev2018-05-041-0/+7
| | | | | | | | | | | | | | | Many glvalue expressions aren't of their respective reference type - they are simply glvalues of their value type. This was causing problems when we were trying to obtain type of the original expression while evaluating certain glvalue bit-casts. Fixed by artificially forging a reference type to provide to the casting procedure. Differential Revision: https://reviews.llvm.org/D46224 llvm-svn: 331558
* [analyzer] Treat more const variables and fields as known contants.Artem Dergachev2018-05-042-3/+52
| | | | | | | | | | | | | | | | When loading from a variable or a field that is declared as constant, the analyzer will try to inspect its initializer and constant-fold it. Upon success, the analyzer would skip normal load and return the respective constant. The new behavior also applies to fields/elements of brace-initialized structures and arrays. Patch by Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45774 llvm-svn: 331556
* [analyzer] NFC: Remove unused parameteer of StoreManager::CastRetrievedVal().Artem Dergachev2018-05-042-17/+5
| | | | llvm-svn: 331496
* Track the result of evaluating a computed noexcept specification on theRichard Smith2018-05-031-2/+2
| | | | | | | | | | | | | | FunctionProtoType. We previously re-evaluated the expression each time we wanted to know whether the type is noexcept or not. We now evaluate the expression exactly once. This is not quite "no functional change": it fixes a crasher bug during AST deserialization where we would try to evaluate the noexcept specification in a situation where we have not deserialized sufficient portions of the AST to permit such evaluation. llvm-svn: 331428
* [analyzer] Revert r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-021-39/+2
| | | | | | | | | The return values of the newly supported functions were not handled correctly: strlcpy()/strlcat() return string sizes rather than pointers. Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331401
* [analyzer] Fix filename in cross-file HTML reportMalcolm Parsons2018-05-021-1/+3
| | | | | | | | | | | | | | | | | Summary: The filename is currently taken from the start of the path, while the line and column are taken from the end of the path. This didn't matter until cross-file path reporting was added. Reviewers: george.karpenkov, dcoughlin, vlad.tsyrklevich Reviewed By: george.karpenkov, vlad.tsyrklevich Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D45611 llvm-svn: 331361
* [analyzer] Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero and VLASize.Henry Wong2018-05-023-25/+31
| | | | | | | | | | | | | | Summary: Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero, VLASize to be able to indicate where the taint information originated from. Reviewers: NoQ, george.karpenkov, xazax.hun, a.sidorin Reviewed By: NoQ Subscribers: szepet, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D46007 llvm-svn: 331345
* PR37189 Fix incorrect end source location and spelling for a split '>>' token.Richard Smith2018-04-302-2/+2
| | | | | | | | | | | | | | | | | | When a '>>' token is split into two '>' tokens (in C++11 onwards), or (as an extension) when we do the same for other tokens starting with a '>', we can't just use a location pointing to the first '>' as the location of the split token, because that would result in our miscomputing the length and spelling for the token. As a consequence, for example, a refactoring replacing 'A<X>' with something else would sometimes replace one character too many, and similarly diagnostics highlighting a template-id source range would highlight one character too many. Fix this by creating an expansion range covering the first character of the '>>' token, whose spelling is '>'. For this to work, we generalize the expansion range of a macro FileID to be either a token range (the common case) or a character range (used in this new case). llvm-svn: 331155
* [analyzer] CStringChecker: Add support for BSD strlcpy() and strlcat().Artem Dergachev2018-04-271-2/+39
| | | | | | | | Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331096
* [analyzer] ObjCAutoreleaseWrite: Support a few more APIs and fix warning text.Artem Dergachev2018-04-271-6/+31
| | | | | | API list and improved warning text composed by Devin Coughlin. llvm-svn: 331089
* [analyzer] Fix operator delete[] array-type-sub-expression handling.Artem Dergachev2018-04-271-2/+4
| | | | | | | | | | | | Avoid crash when the sub-expression of operator delete[] is of array type. This is not the same as simply using a delete[] syntax. We're still not properly calling destructors in this case in the analyzer. Differential Revision: https://reviews.llvm.org/D46146 llvm-svn: 331014
* [analyzer] Fix a crash on lifetime extension through aggregate initialization.Artem Dergachev2018-04-252-6/+22
| | | | | | | | | | | | If 'A' is a C++ aggregate with a reference field of type 'C', in code like A a = { C() }; C() is lifetime-extended by 'a'. The analyzer wasn't expecting this pattern and crashing. Additionally, destructors aren't added in the CFG for this case, so for now we shouldn't be inlining the constructor for C(). Differential Revision: https://reviews.llvm.org/D46037 llvm-svn: 330882
* [analyzer] Enable analysis of WebKit "unified sources".Artem Dergachev2018-04-254-13/+14
| | | | | | | | | | | | | | | | | | | Normally the analyzer begins path-sensitive analysis from functions within the main file, even though the path is allowed to go through any functions within the translation unit. When a recent version of WebKit is compiled, the "unified sources" technique is used, that assumes #including multiple code files into a single main file. Such file would have no functions defined in it, so the analyzer wouldn't be able to find any entry points for path-sensitive analysis. This patch pattern-matches unified file names that are similar to those used by WebKit and allows the analyzer to find entry points in the included code files. A more aggressive/generic approach is being planned as well. Differential Revision: https://reviews.llvm.org/D45839 llvm-svn: 330876
* [analyzer] Add support for the note diagnostic pieces to plist output format.Artem Dergachev2018-04-241-29/+97
| | | | | | | | | | | | | | | | | Note diagnostic pieces are an additional way of highlighting code sections to the user. They aren't part of the normal path diagnostic sequence. They can also be attached to path-insensitive reports. Notes are already supported by the text output and scan-build. Expanding our machine-readable plist output format to be able to represent notes opens up the possibility for various analyzer GUIs to pick them up. Patch by Umann Kristóf! Differential Revision: https://reviews.llvm.org/D45407 llvm-svn: 330766
* [analyzer] Don't crash on printing ConcreteInt of size >64 bitsAleksei Sidorin2018-04-231-7/+3
| | | | | | | | Printing of ConcreteInts with size >64 bits resulted in assertion failure in get[Z|S]ExtValue() because these methods are only allowed to be used with integers of 64 max bit width. This patch fixes the issue. llvm-svn: 330605
* [analyzer] Move `TaintBugVisitor` from `GenericTaintChecker.cpp` to ↵Henry Wong2018-04-232-39/+21
| | | | | | | | | | | | | | | | `BugReporterVisitors.h`. Summary: `TaintBugVisitor` is a universal visitor, and many checkers rely on it, such as `ArrayBoundCheckerV2.cpp`, `DivZeroChecker.cpp` and `VLASizeChecker.cpp`. Moving `TaintBugVisitor` to `BugReporterVisitors.h` enables other checker can also track where `tainted` value came from. Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45682 llvm-svn: 330596
* [analyzer] CStringChecker.cpp - Code refactoring on bug report.Henry Wong2018-04-231-100/+96
| | | | | | | | | | Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D44557 llvm-svn: 330589
* [analyzer] When we fail to evaluate a pointer cast, escape the pointer.Artem Dergachev2018-04-192-34/+24
| | | | | | | | | | | | | | If a pointer cast fails (evaluates to an UnknownVal, i.e. not implemented in the analyzer) and such cast is in fact the last use of the pointer, the pointer symbol is no longer referenced by the program state and a leak is (mis-)diagnosed. "Escape" the pointer upon a failed cast, i.e. inform the checker that we can no longer reliably track it. Differential Revision: https://reviews.llvm.org/D45698 llvm-svn: 330380
* [analyzer] RetainCount: Accept more "safe" CFRetain wrappers.Artem Dergachev2018-04-191-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | r315736 added support for the misplaced CF_RETURNS_RETAINED annotation on CFRetain() wrappers. It works by trusting the function's name (seeing if it confirms to the CoreFoundation naming convention) rather than the annotation. There are more false positives caused by users using a different naming convention, namely starting the function name with "retain" or "release" rather than suffixing it with "retain" or "release" respectively. Because this isn't according to the naming convention, these functions are usually inlined and the annotation is therefore ignored, which is correct. But sometimes we run out of inlining stack depth and the function is evaluated conservatively and then the annotation is trusted. Add support for the "alternative" naming convention and test the situation when we're running out of inlining stack depth. rdar://problem/18270122 Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 330375
* Clean carriage returns from lib/ and include/. NFC.Malcolm Parsons2018-04-161-330/+330
| | | | | | | | | | | | | | | | | | | | | | | | Summary: Clean carriage returns from lib/ and include/. NFC. (I have to make this change locally in order for `git diff` to show sane output after I edit a file, so I might as well ask for it to be committed. I don't have commit privs myself.) (Without this patch, `git rebase`ing any change involving SemaDeclCXX.cpp is a real nightmare. :( So while I have no right to ask for this to be committed, geez would it make my workflow easier if it were.) Here's the command I used to reformat things. (Requires bash and OSX/FreeBSD sed.) git grep -l $'\r' lib include | xargs sed -i -e $'s/\r//' find lib include -name '*-e' -delete Reviewers: malcolm.parsons Reviewed By: malcolm.parsons Subscribers: emaste, krytarowski, cfe-commits Differential Revision: https://reviews.llvm.org/D45591 Patch by Arthur O'Dwyer. llvm-svn: 330112
* [analyzer] Do not invalidate the `this` pointer.Henry Wong2018-04-152-0/+15
| | | | | | | | | | | | | | | | | Summary: `this` pointer is not an l-value, although we have modeled `CXXThisRegion` for `this` pointer, we can only bind it once, which is when we start to inline method. And this patch fixes https://bugs.llvm.org/show_bug.cgi?id=35506. In addition, I didn't find any other cases other than loop-widen that could invalidate `this` pointer. Reviewers: NoQ, george.karpenkov, a.sidorin, seaneveson, szepet Reviewed By: NoQ Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45491 llvm-svn: 330095
* [Analyzer] Fix for SValBuilder expressions rearrangementAdam Balogh2018-04-131-0/+2
| | | | | | | | Expression rearrangement in SValBuilder (see rL329780) crashes with an assert if the type of the integer is different from the type of the symbol. This fix adds a check that prevents rearrangement in such cases. Differential Revision: https://reviews.llvm.org/D45557 llvm-svn: 330064
* [analyzer] Fix null deref in AnyFunctionCall::getRuntimeDefinitionGabor Horvath2018-04-131-16/+17
| | | | | | | | Patch by: Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45564 llvm-svn: 330009
* [Analyzer] SValBuilder Comparison Rearrangement (with Restrictions and ↵Adam Balogh2018-04-112-0/+199
| | | | | | | | | | | | | | | | Analyzer Option) Since the range-based constraint manager (default) is weak in handling comparisons where symbols are on both sides it is wise to rearrange them to have symbols only on the left side. Thus e.g. A + n >= B + m becomes A - B >= m - n which enables the constraint manager to store a range m - n .. MAX_VALUE for the symbolic expression A - B. This can be used later to check whether e.g. A + k == B + l can be true, which is also rearranged to A - B == l - k so the constraint manager can check whether l - k is in the range (thus greater than or equal to m - n). The restriction in this version is the the rearrangement happens only if both the symbols and the concrete integers are within the range [min/4 .. max/4] where min and max are the minimal and maximal values of their type. The rearrangement is not enabled by default. It has to be enabled by using -analyzer-config aggressive-relational-comparison-simplification=true. Co-author of this patch is Artem Dergachev (NoQ). Differential Revision: https://reviews.llvm.org/D41938 llvm-svn: 329780
* Sort source lists in lib/StaticAnalyzer.Nico Weber2018-04-072-2/+2
| | | | llvm-svn: 329481
* Fix typos in clangAlexander Kornienko2018-04-0611-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found via codespell -q 3 -I ../clang-whitelist.txt Where whitelist consists of: archtype cas classs checkk compres definit frome iff inteval ith lod methode nd optin ot pres statics te thru Patch by luzpaz! (This is a subset of D44188 that applies cleanly with a few files that have dubious fixes reverted.) Differential revision: https://reviews.llvm.org/D44188 llvm-svn: 329399
* Make helpers static. NFC.Benjamin Kramer2018-04-042-5/+4
| | | | llvm-svn: 329170
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-04-032-126/+140
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 329115
* [analyzer] Fix diagnostics in callees of interesting callees.Artem Dergachev2018-04-031-9/+6
| | | | | | | | | | | | | | | removeUnneededCalls() is responsible for removing path diagnostic pieces within functions that don't contain "interesting" events. It makes bug reports much tidier. When a stack frame is known to be interesting, the function doesn't descend into it to prune anything within it, even other callees that are totally boring. Fix the function to prune boring callees in interesting stack frames. Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 329102
* [Attr] [NFC] Revert accidental change from r327405Joel E. Denny2018-04-021-1/+1
| | | | llvm-svn: 329005
* [analyzer] Unroll the loop when it has a unsigned counter.Henry Wong2018-03-311-7/+9
| | | | | | | | | | | | | | | | | Summary: The original implementation in the `LoopUnrolling.cpp` didn't consider the case where the counter is unsigned. This case is only handled in `simpleCondition()`, but this is not enough, we also need to deal with the unsinged counter with the counter initialization. Since `IntegerLiteral` is `signed`, there is a `ImplicitCastExpr<IntegralCast>` in `unsigned counter = IntergerLiteral`. This patch add the `ignoringParenImpCasts()` in the `IntegerLiteral` matcher. Reviewers: szepet, a.sidorin, NoQ, george.karpenkov Reviewed By: szepet, george.karpenkov Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45086 llvm-svn: 328919
* [analyzer] Fix assertion crash in CStringCheckerGeorge Karpenkov2018-03-311-5/+8
| | | | | | | | | | An offset might be unknown. rdar://39054939 Differential Revision: https://reviews.llvm.org/D45115 llvm-svn: 328912
* [analyzer] Cache offset computation for MemRegionGeorge Karpenkov2018-03-311-31/+36
| | | | | | | | | | | | | Achieves almost a 200% speedup on the example where the performance of visitors was problematic. Performance on sqlite3 is unaffected. rdar://38818362 Differential Revision: https://reviews.llvm.org/D45113 llvm-svn: 328911
* [analyzer] Track null or undef values through pointer arithmetic.Artem Dergachev2018-03-301-8/+18
| | | | | | | | | | | | | | | | | | Pointer arithmetic on null or undefined pointers results in null or undefined pointers. This is obvious for undefined pointers; for null pointers it follows from our incorrect-but-somehow-working approach that declares that 0 (Loc) doesn't necessarily represent a pointer of numeric address value 0, but instead it represents any pointer that will cause a valid "null pointer dereference" issue when dereferenced. For now we've been seeing through pointer arithmetic at the original dereference expression, i.e. in bugreporter::getDerefExpr(), but not during further investigation of the value's origins in bugreporter::trackNullOrUndefValue(). The patch fixes it. Differential Revision: https://reviews.llvm.org/D45071 llvm-svn: 328896
* [CFG] [analyzer] Avoid modeling C++17 constructors that aren't fully supported.Artem Dergachev2018-03-301-6/+17
| | | | | | | | | | | | | | Not enough work has been done so far to ensure correctness of construction contexts in the CFG when C++17 copy elision is in effect, so for now we should drop construction contexts in the CFG and in the analyzer when they seem different from what we support anyway. This includes initializations with conditional operators and return values across multiple stack frames. Differential Revision: https://reviews.llvm.org/D44854 llvm-svn: 328893
* [analyzer] Remove the unused method declaration in `ValistChecker.cpp`.Henry Wong2018-03-301-1/+0
| | | | | | | | | | | | | | Summary: `getVariableNameFromRegion()` seems useless. Reviewers: xazax.hun, george.karpenkov Reviewed By: xazax.hun Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45081 llvm-svn: 328860
* [analyzer] Better pretty-printing of regions in exploded graphGeorge Karpenkov2018-03-292-3/+8
| | | | | | Differential Revision: https://reviews.llvm.org/D45010 llvm-svn: 328835
* [analyzer] Path-insensitive checker for writes into an auto-releasing pointerGeorge Karpenkov2018-03-292-0/+158
| | | | | | | | | | from the wrong auto-releasing pool, as such writes may crash. rdar://25301111 Differential Revision: https://reviews.llvm.org/D44722 llvm-svn: 328827
* [clang] Change std::sort to llvm::sort in response to r327219Mandeep Singh Grang2018-03-273-6/+6
| | | | | | | | | | | r327219 added wrappers to std::sort which randomly shuffle the container before sorting. This will help in uncovering non-determinism caused due to undefined sorting order of objects having the same key. To make use of that infrastructure we need to invoke llvm::sort instead of std::sort. llvm-svn: 328636
OpenPOWER on IntegriCloud