summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Fix a crash reported in PR 14400.Anna Zaks2012-11-262-1/+3
| | | | | | | | The AllocaRegion did not have the superRegion (based on LocationContext) as part of it's hash. As a consequence, the AllocaRegions from different frames were uniqued to be the same region. llvm-svn: 168599
* Make helpers static/anonymous.Benjamin Kramer2012-11-221-2/+2
| | | | llvm-svn: 168500
* [analyzer] Fix a use-after-free introduced in r168019.Jordan Rose2012-11-151-4/+5
| | | | | | | | | | | | | | | | | | | | | | | In code like this: void foo() { bar(); baz(); } ...the location for the call to 'bar()' was being used as a backup location for the call to 'baz()'. This is fine unless the call to 'bar()' is deemed uninteresting and that part of the path deleted. (This looks like a logic error as well, but in practice the only way 'baz()' could have an invalid location is if the entire body of 'foo()' is synthesized, meaning the call to 'bar()' will be using the location of the call to 'foo()' anyway. Nevertheless, the new version better matches the intent of the code.) Found by Matt Beaumont-Gay using ASan. Thanks, Matt! llvm-svn: 168080
* [analyzer] Report leaks at the closing brace of a function body.Jordan Rose2012-11-153-13/+24
| | | | | | | | | | | | | | | | | | | | This fixes a few cases where we'd emit path notes like this: +---+ 1| v p = malloc(len); ^ |2 +---+ In general this should make path notes more consistent and more correct, especially in cases where the leak happens on the false branch of an if that jumps directly to the end of the function. There are a couple places where the leak is reported farther away from the cause; these are usually cases where there are several levels of nested braces before the end of the function. This still matches our current behavior for when there /is/ a statement after all the braces, though. llvm-svn: 168070
* [analyzer] StreamChecker: Remove now-unnecessary check::EndPath callback.Jordan Rose2012-11-151-46/+1
| | | | | | | Also, don't bother to stop tracking symbols in the return value, either. They are now properly considered live during checkDeadSymbols. llvm-svn: 168069
* [analyzer] MacOSKeychainAPIChecker: Remove now-unnecessary check::EndPath.Jordan Rose2012-11-151-75/+0
| | | | | | | Also, don't bother to stop tracking symbols in the return value, either. They are now properly considered live during checkDeadSymbols. llvm-svn: 168068
* [analyzer] MallocChecker: Remove now-unnecessary check::EndPath callback.Jordan Rose2012-11-151-29/+1
| | | | | | | Also, don't bother to stop tracking symbols in the return value, either. They are now properly considered live during checkDeadSymbols. llvm-svn: 168067
* [analyzer] Mark symbol values as dead in the environment.Jordan Rose2012-11-153-20/+37
| | | | | | | | | | | | | | This allows us to properly remove dead bindings at the end of the top-level stack frame, using the ReturnStmt, if there is one, to keep the return value live. This in turn removes the need for a check::EndPath callback in leak checkers. This does cause some changes in the path notes for leak checkers. Previously, a leak would be reported at the location of the closing brace in a function. Now, it gets reported at the last statement. This matches the way leaks are currently reported for inlined functions, but is less than ideal for both. llvm-svn: 168066
* [analyzer] Make sure calls in synthesized functions have valid path locations.Jordan Rose2012-11-152-10/+20
| | | | | | | | | | | | | | | | | | We do this by using the "most recent" good location: if a synthesized function 'A' calls another function 'B', the path notes for the call to 'B' will be placed at the same location as the path note for calling 'A'. Similarly, the call to 'A' will have a note saying "Entered call from...", and now we just don't emit that (since the user doesn't have a body to look at anyway). Previously, we were doing this for the "Calling..." notes, but not for the "Entered call from..." or "Returning to caller". This caused a crash when the path entered and then exiting a call within a synthesized body. <rdar://problem/12657843> llvm-svn: 168019
* [analyzer] Address Jordan's code review for r167813.Anna Zaks2012-11-131-20/+15
| | | | | | | This simplifies logic, fixes a bug, and adds a test case. Thanks Jordan! llvm-svn: 167868
* Fix a Malloc Checker FP by tracking return values from initWithCharacterAnna Zaks2012-11-131-20/+81
| | | | | | | | | | and other functions. When these functions return null, the pointer is not freed by them/ownership is not transfered. So we should allow the user to free the pointer by calling another function when the return value is NULL. llvm-svn: 167813
* [analyzer] Address Jordan's feedback for r167780.Anna Zaks2012-11-131-4/+5
| | | | llvm-svn: 167790
* [analyzer] Follow up to r167762 - precisely determine the adjustmentAnna Zaks2012-11-121-3/+13
| | | | | | | | | | | | | | | | | conditions. The adjustment is needed only in case of dynamic dispatch performed by the analyzer - when the runtime declaration is different from the static one. Document this explicitly in the code (by adding a helper). Also, use canonical Decls to avoid matching against the case where the definition is different from found declaration. This fix suppresses the testcase I added in r167762, so add another testcase to make sure we do test commit r167762. llvm-svn: 167780
* [analyzer] Fix a regression (from r 165079): compare canonical types.Anna Zaks2012-11-121-0/+2
| | | | | | | | | | | Suppresses a leak false positive (radar://12663777). In addition, we'll need to rewrite the adjustReturnValue() method not to return UnknownVal by default, but rather assert in cases we cannot handle. To make it possible, we need to correctly handle some of the edge cases we already know about. llvm-svn: 167762
* [analyzer] When invalidating symbolic offset regions, take fields into account.Jordan Rose2012-11-101-6/+63
| | | | | | | | | | | | | | | | | | | Previously, RegionStore was being VERY conservative in saying that because p[i].x and p[i].y have a concrete base region of 'p', they might overlap. Now, we check the chain of fields back up to the base object and check if they match. This only kicks in when dealing with symbolic offset regions because RegionStore's "base+offset" representation of concrete offset regions loses all information about fields. In cases where all offsets are concrete (s.x and s.y), RegionStore will already do the right thing, but mixing concrete and symbolic offsets can cause bindings to be invalidated that are known to not overlap (e.g. p[0].x and p[i].y). This additional refinement is tracked by <rdar://problem/12676180>. <rdar://problem/12530149> llvm-svn: 167654
* [analyzer] Check that the argument to CFMakeCollectable is non-NULL.Jordan Rose2012-11-072-10/+18
| | | | | | Patch by Sean McBride! llvm-svn: 167537
* [analyzer] Enhance docs for checker callbacks (esp. processRegionChanges).Jordan Rose2012-11-071-13/+28
| | | | | | No functionality change; this checker is only used for documentation. llvm-svn: 167522
* [analyzer] Add symbol escapes logic to the SimpleStreamChecker.Anna Zaks2012-11-061-1/+125
| | | | llvm-svn: 167439
* [analyzer] Remove isWithinInlined. It's been replaced with inTopFrame().Anna Zaks2012-11-061-1/+1
| | | | | | Thanks Jordan. llvm-svn: 167438
* [analyzer] Move convenience REGISTER_*_WITH_PROGRAMSTATE to CheckerContext.hJordan Rose2012-11-053-6/+9
| | | | | | | | | | | | As Anna pointed out, ProgramStateTrait.h is a relatively obscure header, and checker writers may not know to look there to add their own custom state. The base macro that specializes the template remains in ProgramStateTrait.h (REGISTER_TRAIT_WITH_PROGRAMSTATE), which allows the analyzer core to keep using it. llvm-svn: 167385
* StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp: Appease msvc.NAKAMURA Takumi2012-11-031-2/+2
| | | | | | 0 (as nullptr) is incompatible to pointer in type matching on msvc. llvm-svn: 167355
* [analyzer] Run remove dead on end of path.Anna Zaks2012-11-034-8/+65
| | | | | | | | | | | | | This will simplify checkers that need to register for leaks. Currently, they have to register for both: check dead and check end of path. I've modified the SymbolReaper to consider everything on the stack dead if the input StackLocationContext is 0. (This is a bit disruptive, so I'd like to flash out all the issues asap.) llvm-svn: 167352
* [analyzer] add LocationContext::inTopFrame() helper.Anna Zaks2012-11-031-7/+1
| | | | llvm-svn: 167351
* [analyzer] Refactor: Remove Pred from NodeBuilderContext.Anna Zaks2012-11-033-12/+12
| | | | | | Node builders should manage the nodes, not the context. llvm-svn: 167350
* [analyzer] Convert SimpleStreamChecker over to CallEvent.Jordan Rose2012-11-021-13/+23
| | | | llvm-svn: 167340
* [analyzer] CheckerDocumentation: Change examples for PreStmt and PostStmt.Jordan Rose2012-11-021-9/+9
| | | | llvm-svn: 167339
* [analyzer] Add some convenience accessors to CallEvent, and use them.Jordan Rose2012-11-025-12/+31
| | | | | | | | These are CallEvent-equivalents of helpers already accessible in CheckerContext, as part of making it easier for new checkers to be written using CallEvent rather than raw CallExprs. llvm-svn: 167338
* [analyzer] isCLibraryFunction: check that the function is at TU-scope.Jordan Rose2012-11-022-11/+18
| | | | | | | Also, Decls already carry a pointer to the ASTContext, so there's no need to pass an extra argument to the predicate. llvm-svn: 167337
* [analyzer] Factor SimpleStreamChecker pulling out isLeaked().Anna Zaks2012-11-021-15/+21
| | | | llvm-svn: 167316
* [analyzer] Convert some of the harder cases over to ProgramStateTrait macros.Jordan Rose2012-11-023-62/+24
| | | | | | | Add FIXMEs for the traits visible from multiple translation units. Currently the macros hide their key types in an anonymous namespace. llvm-svn: 167277
* [analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose2012-11-0210-158/+63
| | | | | | | | | Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. llvm-svn: 167276
* [analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose2012-11-0242-80/+80
| | | | | | No functionality change. llvm-svn: 167275
* [analyzer] Fix typo in r167186.Jordan Rose2012-11-011-1/+1
| | | | llvm-svn: 167189
* [analyzer] Minor cleanup in SimpleStreamChecker's class definition.Jordan Rose2012-11-011-8/+8
| | | | | | No functionality change. llvm-svn: 167187
* [analyzer] Rename ConditionTruthVal::isTrue to isConstrainedTrue.Jordan Rose2012-11-014-9/+23
| | | | | | | | (and the same for isFalse) No functionality change. llvm-svn: 167186
* [analyzer] Fix a bug in SimpleStreamChecker - return after sink.Anna Zaks2012-10-311-1/+3
| | | | | | Thanks Ted. llvm-svn: 167176
* [analyzer] Let ConstraintManager subclasses provide a more efficient checkNull.Jordan Rose2012-10-312-8/+27
| | | | | | | | | | | Previously, every call to a ConstraintManager's isNull would do a full assumeDual to test feasibility. Now, ConstraintManagers can override checkNull if they have a cheaper way to do the same thing. RangeConstraintManager can do this in less than half the work. <rdar://problem/12608209> llvm-svn: 167138
* [analyzer] SimpleStreamChecker - remove evalAssume and other refinementsAnna Zaks2012-10-311-56/+30
| | | | llvm-svn: 167099
* [analyzer]Don't invalidate const arguments when there is noAnna Zaks2012-10-311-1/+1
| | | | | | | IdentifierInfo. Ee: C++ copy constructors. llvm-svn: 167092
* Trim #includes.Ted Kremenek2012-10-301-8/+6
| | | | llvm-svn: 167002
* [analyzer]SimpleStreamChecker: add a TODO for better leak report.Anna Zaks2012-10-301-0/+2
| | | | llvm-svn: 167001
* [analyzer] Fix a bug in REGISTER_MAP_WITH_PROGRAMSTATEAnna Zaks2012-10-301-7/+5
| | | | | | | | | | | The ImmutableMap should not be the key into the GDM map as there could be several entries with the same map type. Thanks, Jordan. This complicates the usage of the macro a bit. When we want to retrieve the whole map, we need to use another name. Currently, I set it to be Name ## Ty as in "type of the map we are storing in the ProgramState". llvm-svn: 167000
* [analyzer] Rename REGISTER_MAP_WITH_GDM ->REGISTER_MAP_WITH_PROGRAMSTATEAnna Zaks2012-10-301-2/+2
| | | | llvm-svn: 166999
* [analyzer] Warn about reallocf with an allocation size of 0, like realloc.Jordan Rose2012-10-301-1/+9
| | | | | | Patch by Sean McBride! llvm-svn: 166995
* [analyzer] New checker for missing super calls in UIViewController subclasses.Jordan Rose2012-10-303-0/+208
| | | | | | | | | | | | This is a syntactic checker aimed at helping iOS programmers correctly subclass and override the methods of UIViewController. While this should eventually be covered by the 'objc_requires_super' attribute, this checker can be used with the existing iOS SDKs without any header changes. This new checker is currently named 'alpha.osx.cocoa.MissingSuperCall'. Patch by Julian Mayer! llvm-svn: 166993
* [analyzer] Malloc checker cleanup/refactorAnna Zaks2012-10-291-9/+7
| | | | | | | No need for the auxiliary flag. No need to generate a leak node when there is no error. llvm-svn: 166977
* [analyzer] Add SimpleStreamChecker.Anna Zaks2012-10-293-0/+234
| | | | | | This is an example checker for catching fopen fclose API misuses. llvm-svn: 166976
* [analyzer] Add checker helpers to CheckerContext.Anna Zaks2012-10-291-0/+2
| | | | | | - Adding Immutable Map to GDM and getIdentifierInfo helper method. llvm-svn: 166975
* [analyzer] New option to not suppress null return paths if an argument is null.Jordan Rose2012-10-293-17/+109
| | | | | | | | | | | | | | | | | | Our one basic suppression heuristic is to assume that functions do not usually return NULL. However, when one of the arguments is NULL it is suddenly much more likely that NULL is a valid return value. In this case, we don't suppress the report here, but we do attach /another/ visitor to go find out if this NULL argument also comes from an inlined function's error path. This new behavior, controlled by the 'avoid-suppressing-null-argument-paths' analyzer-config option, is turned off by default. Turning it on produced two false positives and no new true positives when running over LLVM/Clang. This is one of the possible refinements to our suppression heuristics. <rdar://problem/12350829> llvm-svn: 166941
* [analyzer] Use the CallEnter node to get a value for tracked null arguments.Jordan Rose2012-10-292-27/+50
| | | | | | | | | | | | | | | | Additionally, don't collect PostStore nodes -- they are often used in path diagnostics. Previously, we tried to track null arguments in the same way as any other null values, but in many cases the necessary nodes had already been collected (a memory optimization in ExplodedGraph). Now, we fall back to using the value of the argument at the time of the call, which may not always match the actual contents of the region, but often will. This is a precursor to improving our suppression heuristic. <rdar://problem/12350829> llvm-svn: 166940
OpenPOWER on IntegriCloud