summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] MallocChecker should not do post-call checks on inlined functions.Jordan Rose2012-09-201-0/+3
| | | | | | | | | | | If someone provides their own function called 'strdup', or 'reallocf', or even 'malloc', and we inlined it, the inlining should have given us all the malloc-related information we need. If we then try to attach new information to the return value, we could end up with spurious warnings. <rdar://problem/12317671> llvm-svn: 164276
* Revert "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose2012-09-202-8/+9
| | | | | | | | | | | | | | | | | removeDeadBindings." While we definitely want this optimization in the future, we're not currently handling constraints on symbolic /expressions/ correctly. These should stay live even if the SymExpr itself is no longer referenced because could recreate an identical SymExpr later. Only once the SymExpr can no longer be recreated -- i.e. a component symbol is dead -- can we safely remove the constraints on it. This liveness issue is tracked by <rdar://problem/12333297>. This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8. llvm-svn: 164275
* [analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks2012-09-174-11/+10
| | | | | | | | | | | in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. llvm-svn: 164046
* Fix grammar.Ted Kremenek2012-09-131-4/+4
| | | | llvm-svn: 163828
* When warning about unsafe uses of dispatch_once, specially handle theTed Kremenek2012-09-131-1/+13
| | | | | | | | | | crazy case where dispatch_once gets redefined as a macro that calls _dispatch_once (which calls the real dispatch_once). Users want to see the warning in their own code. Fixes <rdar://problem/11617767> llvm-svn: 163816
* [analyzer] Don't reimplement an existing function.Anna Zaks2012-09-131-17/+1
| | | | | | Thanks Jordan. llvm-svn: 163762
* Refactor logic in ExprEngine for detecting 'noreturn' methodsTed Kremenek2012-09-132-58/+9
| | | | | | | | | | in NSException to a helper object in libAnalysis that can also be used by Sema. Not sure if the predicate name 'isImplicitNoReturn' is the best one, but we can massage that later. No functionality change. llvm-svn: 163759
* [analyzer] Do not report use of undef on "return foo();" when the return ↵Anna Zaks2012-09-122-0/+24
| | | | | | | | type is void. Fixes a false positive found by analyzing LLVM code base. llvm-svn: 163750
* [analyzer] Fix another false positive in malloc realloc logic.Anna Zaks2012-09-121-13/+32
| | | | llvm-svn: 163749
* [analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks2012-09-122-3/+25
| | | | llvm-svn: 163748
* [analyzer] Fix another use of the address of a temporary, like r163402.Jordan Rose2012-09-121-1/+2
| | | | | | | | | Again, GCC is more aggressive about reusing temporary space than we are, leading to Release build crashes for this undefined behavior. PR13710 (though it may not be the only problem there) llvm-svn: 163747
* [analyzer] Handle when the dynamic type is worse than the static type.Jordan Rose2012-09-121-1/+8
| | | | | | | | | | | | | | | Currently we don't update the dynamic type of a C++ object when it is cast. This can cause the situation above, where the static type of the region is now known to be a subclass of the dynamic type. Once we start updating DynamicTypeInfo in response to the various kinds of casts in C++, we can re-add this assert to make sure we don't miss any cases. This work is tracked by <rdar://problem/12287087>. In -Asserts builds, we will simply not return any runtime definition when our DynamicTypeInfo is known to be incorrect like this. llvm-svn: 163745
* Revert "[analyzer] Use the static type for a virtual call if the dynamic ↵Jordan Rose2012-09-121-10/+3
| | | | | | | | | | | | type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. llvm-svn: 163744
* Fix regression where "looping back to the head of" PathDiagnosticEventsTed Kremenek2012-09-121-12/+7
| | | | | | | | were not emitted. Fixes <rdar://problem/12280665>. llvm-svn: 163683
* PR13811: Add a FunctionParmPackExpr node to handle references to functionRichard Smith2012-09-121-0/+1
| | | | | | | parameter packs where the reference is not being expanded but the pack has been. Previously, Clang would segfault in such cases. llvm-svn: 163672
* Revert "[analyzer] Disable STL inlining. Blocked by PR13724."Jordan Rose2012-09-111-1/+1
| | | | | | | | | | | While PR13724 is still an issue, it's not actually an issue in the STL. We can keep this option around in case there turn out to be widespread false positives due to poor modeling of the C++ standard library functions, but for now we'd like to get more data. This reverts r163633 / c6baadceec1d5148c20ee6c902a102233c547f62. llvm-svn: 163647
* [analyzer] Use the static type for a virtual call if the dynamic type is worse.Jordan Rose2012-09-111-3/+10
| | | | | | | | | | | | | reinterpret_cast does not provide any of the usual type information that static_cast or dynamic_cast provide -- only the new type. This can get us in a situation where the dynamic type info for an object is actually a superclass of the static type, which does not match what CodeGen does at all. In these cases, just fall back to the static type as the best possible type for devirtualization. Should fix the crashes on our internal buildbot. llvm-svn: 163644
* [analyzer] Disable STL inlining. Blocked by PR13724.Anna Zaks2012-09-111-1/+1
| | | | llvm-svn: 163633
* [analyzer] Member function calls that use qualified names are non-virtual.Jordan Rose2012-09-111-0/+12
| | | | | | | | | | | C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> llvm-svn: 163577
* [analyzer] Turn stl inlining back on.Anna Zaks2012-09-101-1/+1
| | | | | | | The one reported bug, which was exposed by stl inlining, is addressed in r163558. llvm-svn: 163574
* [analyzer] Do not count calls to small functions when computing stackAnna Zaks2012-09-101-3/+18
| | | | | | | | | depth. We only want to count how many substantial functions we inlined. This is an improvement to r163558. llvm-svn: 163571
* [analyzer] Add an option to enable/disable objc inlining.Anna Zaks2012-09-102-3/+12
| | | | llvm-svn: 163562
* [analyzer] Add ipa-always-inline-size option (with 3 as the default).Anna Zaks2012-09-102-7/+39
| | | | | | | | The option allows to always inline very small functions, whose size (in number of basic blocks) is set using -analyzer-config ipa-always-inline-size option. llvm-svn: 163558
* [analyzer] Make the defaults explicit for each of the new config options.Jordan Rose2012-09-101-2/+2
| | | | | | Also, document both new inlining options in IPA.txt. llvm-svn: 163551
* [analyzer] For now, don't inline C++ standard library functions.Jordan Rose2012-09-102-1/+61
| | | | | | | | | | | | | | | | This is a (heavy-handed) solution to PR13724 -- until we know we can do a good job inlining the STL, it's best to be consistent and not generate more false positives than we did before. We can selectively whitelist certain parts of the 'std' namespace that are known to be safe. This is controlled by analyzer config option 'c++-stdlib-inlining', which can be set to "true" or "false". This commit also adds control for whether or not to inline any templated functions (member or non-member), under the config option 'c++-template-inlining'. This option is currently on by default. llvm-svn: 163548
* Remove redundant semicolons which are null statements.Dmitri Gribenko2012-09-101-1/+1
| | | | llvm-svn: 163546
* Fix another case where we should be using isBeforeInTranslationUnit().Ted Kremenek2012-09-101-2/+4
| | | | llvm-svn: 163533
* Add a few more cases where we should be using isBeforeInTranslationUnit().Ted Kremenek2012-09-101-2/+4
| | | | llvm-svn: 163531
* Revert "Revert Ted's r163489 and r163490, due to breakage."Ted Kremenek2012-09-101-11/+135
| | | | | | | | | I need to see how this breaks on other platforms when I fix the issue that Benjamin Kramer pointed out. This includes r163489 and r163490, plus a two line change. llvm-svn: 163512
* Make helper functions static.Benjamin Kramer2012-09-102-5/+5
| | | | llvm-svn: 163505
* Revert Ted's r163489 and r163490, due to breakage.NAKAMURA Takumi2012-09-101-135/+11
| | | | | | | r163489, "Take another crack at stabilizing the emission order of analyzer" r163490, "Use isBeforeInTranslationUnitThan() instead of operator<." llvm-svn: 163497
* Use isBeforeInTranslationUnitThan() instead of operator<.Ted Kremenek2012-09-101-7/+7
| | | | llvm-svn: 163490
* Take another crack at stabilizing the emission order of analyzerTed Kremenek2012-09-101-11/+135
| | | | | | | | | | | | | | diagnostics without using FoldingSetNodeIDs. This is done by doing a complete recursive comparison of the PathDiagnostics. Note that the previous method of comparing FoldingSetNodeIDs did not end up relying on unstable things such as pointer addresses, so I suspect this may still have some issues on various buildbots because I'm not sure if the true source of non-determinism has been eliminated. The tests pass for me, so the only way to know is to commit this change and see what happens. llvm-svn: 163489
* Indent the "message" key in analyzer plist output.Ted Kremenek2012-09-101-0/+1
| | | | llvm-svn: 163487
* Remove dead method ProgramState::MarshalState().Ted Kremenek2012-09-091-11/+0
| | | | llvm-svn: 163479
* Fix bug in BugReporter::RemoveUneededCalls() where "prunable"Ted Kremenek2012-09-082-5/+2
| | | | | | | PathDiagnosticEventPieces were *always* pruned. Instead, they are suppose to only be pruned if the entire call gets pruned. llvm-svn: 163460
* Attempt (again) to stabilize the order of the emission of diagnosticsTed Kremenek2012-09-081-31/+17
| | | | | | | of the analyzer by using the FullProfile() of a PathDiagnostic for ordering them. llvm-svn: 163455
* [analyzer] ObjCSelfInitChecker should always clean up in postCall checks.Jordan Rose2012-09-082-6/+7
| | | | | | | | | | | | | | | | | | | | ObjCSelfInitChecker stashes information in the GDM to persist it across function calls; it is stored in pre-call checks and retrieved post-call. The post-call check is supposed to clear out the stored state, but was failing to do so in cases where the call did not have a symbolic return value. This was actually causing the inappropriate cache-out from r163361. Per discussion with Anna, we should never actually cache out when assuming the receiver of an Objective-C message is non-nil, because we guarded that node generation by checking that the state has changed. Therefore, the only states that could reach this exact ExplodedNode are ones that should have merged /before/ making this assumption. r163361 has been reverted and the test case removed, since it won't actually test anything interesting now. llvm-svn: 163449
* [analyzer] Add debug output for ObjCSelfInitChecker's state.Jordan Rose2012-09-081-0/+48
| | | | | | No functionality change. llvm-svn: 163448
* Revert "Attempt to make the PathDiagnostic emission order more deterministic by"Ted Kremenek2012-09-081-38/+3
| | | | llvm-svn: 163446
* Revert "Further tweaks to hopefully make the PathDiagnostic emission more ↵Ted Kremenek2012-09-081-8/+18
| | | | | | deterministic." llvm-svn: 163445
* [analyzer] Remove constraints on dead symbols as part of removeDeadBindings.Jordan Rose2012-09-082-9/+8
| | | | | | | | | | | | | Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. llvm-svn: 163444
* [analyzer] Symbolic regions are live if any subregions are live.Jordan Rose2012-09-081-21/+9
| | | | | | | | | | RegionStoreManager was only treating a SymbolicRegion's symbel as live if there was a binding referring to the region itself. No test case because constraints are currently not being cleaned out of the constraint manager at all (even if the symbol is legitimately dead). llvm-svn: 163443
* [analyzer] Cast the result of a placement new-expression to the correct type.Jordan Rose2012-09-081-1/+3
| | | | | | | | | | | This is necessary because further analysis will assume that the SVal's type matches the AST type. This caused a crash when trying to perform a derived-to-base cast on a C++ object that had been new'd to be another object type. Yet another crash in PR13763. llvm-svn: 163442
* [analyzer] Address John's code review for r163407.Anna Zaks2012-09-081-12/+15
| | | | | | | Teach malloc sizeof checker to find type inconsistencies in multi- dimensional arrays. llvm-svn: 163438
* Further tweaks to hopefully make the PathDiagnostic emission more deterministic.Ted Kremenek2012-09-071-18/+8
| | | | llvm-svn: 163430
* Remove ProgramState::getSymVal(). It was being misused by Checkers,Ted Kremenek2012-09-078-21/+65
| | | | | | | | | | | | | | | | | | | | with at least one subtle bug in MacOSXKeyChainAPIChecker where the calling the method was a substitute for assuming a symbolic value was null (which is not the case). We still keep ConstraintManager::getSymVal(), but we use that as an optimization in SValBuilder and ProgramState::getSVal() to constant-fold SVals. This is only if the ConstraintManager can provide us with that information, which is no longer a requirement. As part of this, introduce a default implementation of ConstraintManager::getSymVal() which returns null. For Checkers, introduce ConstraintManager::isNull(), which queries the state to see if the symbolic value is constrained to be a null value. It does this without assuming it has been implicitly constant folded. llvm-svn: 163428
* Attempt to make the PathDiagnostic emission order more deterministic byTed Kremenek2012-09-071-3/+38
| | | | | | looking at PathPieces. llvm-svn: 163427
* Remove ConstraintManager:isEqual(). It is no longer used.Ted Kremenek2012-09-071-6/+0
| | | | llvm-svn: 163425
* [analyzer] Use cast<> instead of getAs<> for a CFGElement known to be a CFGStmt.Jordan Rose2012-09-071-4/+3
| | | | | | | | | | | | When adding the next statement to the CoreEngine's work list, we take care of all the special cases first. We certainly shouldn't be building PostStmts with null statements (the diagnostics machinery assumes such StmtPoints do not exist), and we should find out sooner if we're missing a special case. A refinement of r163402 that should help prevent further issues like PR13760. llvm-svn: 163409
OpenPOWER on IntegriCloud