summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Fix a false positive in sizeof malloc checker.Anna Zaks2012-09-071-33/+49
| | | | | | | Don't warn when the sizeof argument is an array with the same element type as the pointee of the return type. llvm-svn: 163407
* [analyzer] Don't use the address of a temporary CFGElement.Jordan Rose2012-09-071-1/+2
| | | | | | | | | | | | | | | | | GCC destroys temporary objects more aggressively than clang, so this results in incorrect behavior when compiling GCC Release builds. We could avoid this issue under C++11 by preventing getAs from being called when 'this' is an rvalue: template<class ElemTy> const ElemTy *getAs() const & { ... } template<class ElemTy> const ElemTy *getAs() const && = delete; Unfortunately, we do not have compatibility macros for this behavior yet. This will hopefully fix PR13760 and PR13762. llvm-svn: 163402
* [analyzer] Explain why we need condition 8.Anna Zaks2012-09-071-1/+4
| | | | llvm-svn: 163394
* Fix off-by-one bug in diagnostic prose of ObjCContainersASTChecker.Ted Kremenek2012-09-071-1/+3
| | | | | | | | | While the check itself should count 0-based for the parameter index, the diagnostic should be 1-based (first, second, third, not start at 0). Fixes <rdar://problem/12249569>. llvm-svn: 163375
* ExplodedGraph::shouldCollectNode() should not collect nodes for non-Expr StmtsTed Kremenek2012-09-071-3/+3
| | | | | | | | (as this previously was the case before this was refactored). We also shouldn't need to specially handle BinaryOperators since the eagerly-assume heuristic tags such nodes. llvm-svn: 163374
* Fix bug in ConditionBRVisitor where for C++ (and not C) we were not ignoringTed Kremenek2012-09-071-4/+3
| | | | | | | | | | | | | | | | implicit pointer-to-boolean conversions in condition expressions. This would result in inconsistent diagnostic emission between C and C++. A consequence of this is now ConditionBRVisitor and TrackConstraintBRVisitor may emit redundant diagnostics, for example: "Assuming pointer value is null" (TrackConstraintBRVisitor) "Assuming 'p' is null" (ConditionBRVisitor) We need to reconcile the two, and perhaps prefer one over the other in some cases. llvm-svn: 163372
* [analyzer] Fail gracefully when the dynamic type is outside the hierarchy.Jordan Rose2012-09-071-1/+9
| | | | | | | | | | | | | | | | | | | With some particularly evil casts, we can get an object whose dynamic type is not actually a subclass of its static type. In this case, we won't even find the statically-resolved method as a devirtualization candidate. Rather than assert that this situation cannot occur, we now simply check that the dynamic type is not an ancestor or descendent of the static type, and leave it at that. This error actually occurred analyzing LLVM: CallEventManager uses a BumpPtrAllocator to allocate a concrete subclass of CallEvent (FunctionCall), but then casts it to the actual subclass requested (such as ObjCMethodCall) to perform the constructor. Yet another crash in PR13763. llvm-svn: 163367
* Teach RetainCountChecker that CFPlugInInstanceCreate does notTed Kremenek2012-09-061-0/+2
| | | | | | | | return a CF object at all. Fixes <rdar://problem/9566345> llvm-svn: 163362
* [analyzer] Don't crash if we cache out while evaluating an ObjC message.Jordan Rose2012-09-061-2/+3
| | | | | | | | | | | | | | | | A bizarre series of coincidences led us to generate a previously-seen node in the middle of processing an Objective-C message, where we assume the receiver is non-nil. We were assuming that such an assumption would never "cache out" like this, and blithely went on using a null ExplodedNode as the predecessor for the next step in evaluation. Although the test case committed here is complicated, this could in theory happen in other ways as well, so the correct fix is just to test if the non-nil assumption results in an ExplodedNode we've seen before. <rdar://problem/12243648> llvm-svn: 163361
* Refine diagnostics for leaks reported when returning an objectTed Kremenek2012-09-061-14/+22
| | | | | | | | via function/method with [CF,NS]_RETURNS_NOT_RETAINED. Fixes <rdar://problem/11379000>. llvm-svn: 163355
* Tweak DeadStoresChecker to not warn about dead stores to variables thatTed Kremenek2012-09-061-3/+55
| | | | | | | | | are used in EH code. Right now the CFG doesn't support exceptions well, so we need this hack to avoid bogus dead store warnings. Fixes <rdar://problem/12147586> llvm-svn: 163353
* [analyzer] Don't attempt to devirtualize calls to base class destructors.Jordan Rose2012-09-064-9/+19
| | | | | | | | | | | | | | | | | | | CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. llvm-svn: 163348
* Dont cast away const needlessly. Found by gcc48 -Wcast-qual.Roman Divacky2012-09-064-9/+10
| | | | llvm-svn: 163325
* [analyzer] Enhance the member expr tracking to account for references.Anna Zaks2012-09-052-2/+9
| | | | | | As per Jordan's suggestion. (Came out of code review for r163261.) llvm-svn: 163269
* [analyzer] Always include destructors in the analysis CFG.Jordan Rose2012-09-052-2/+7
| | | | | | | | | | | | | | | | | | | | | While destructors will continue to not be inlined (unless the analyzer config option 'c++-inlining' is set to 'destructors'), leaving them out of the CFG is an incomplete model of the behavior of an object, and can cause false positive warnings (like PR13751, now working). Destructors for temporaries are still not on by default, since (a) we haven't actually checked this code to be sure it's fully correct (in particular, we probably need to be very careful with regard to lifetime-extension when a temporary is bound to a reference, C++11 [class.temporary]p5), and (b) ExprEngine doesn't actually do anything when it sees a temporary destructor in the CFG -- not even invalidate the object region. To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which controlled all implicit destructors, has been removed. llvm-svn: 163264
* [analyzer] Fix a crash PR13762.Anna Zaks2012-09-051-1/+2
| | | | llvm-svn: 163262
* [analyzer] NullOrUndef diagnostics: track symbols binded to regions.Anna Zaks2012-09-051-8/+12
| | | | | | | | | If a region is binded to a symbolic value, we should track the symbol. (The code I changed was not previously exercised by the regression tests.) llvm-svn: 163261
* [analyzer] Remove unneeded code.Anna Zaks2012-09-051-18/+8
| | | | | | | This region is set as interesting as part of trackNullOrUndefValue call, no need to mark it as interesting twice. llvm-svn: 163260
* [analyzer] Be more forgiving about calling methods on struct rvalues.Jordan Rose2012-09-052-3/+23
| | | | | | | | | | | | | | | | | | | | The problem is that the value of 'this' in a C++ member function call should always be a region (or NULL). However, if the object is an rvalue, it has no associated region (only a conjured symbol or LazyCompoundVal). For now, we handle this in two ways: 1) Actually respect MaterializeTemporaryExpr. Before, it was relying on CXXConstructExpr to create temporary regions for all struct values. Now it just does the right thing: if the value is not in a temporary region, create one. 2) Have CallEvent recognize the case where its 'this' pointer is a non-region, and just return UnknownVal to keep from confusing clients. The long-term problem is being tracked internally in <rdar://problem/12137950>, but this makes many test cases pass. llvm-svn: 163220
* [analyzer] Clean up a couple uses of getPointeeType().Jordan Rose2012-09-053-15/+7
| | | | | | No intended functionality change. llvm-svn: 163219
* Revert "[analyzer] Treat all struct values as regions (even rvalues)."Jordan Rose2012-09-052-20/+3
| | | | | | | | | | | | | | This turned out to have many implications, but what eventually seemed to make it unworkable was the fact that we can get struct values (as LazyCompoundVals) from other places besides return-by-value function calls; that is, we weren't actually able to "treat all struct values as regions" consistently across the entire analyzer core. Hopefully we'll be able to come up with an alternate solution soon. This reverts r163066 / 02df4f0aef142f00d4637cd851e54da2a123ca8e. llvm-svn: 163218
* Fix indentation.Ted Kremenek2012-09-041-3/+3
| | | | llvm-svn: 163176
* [analyzer] Don't use makeIntVal to create a floating-point value.Jordan Rose2012-09-041-1/+3
| | | | | | | | | | SimpleSValBuilder processes a couple trivial identities, including 'x - x' and 'x ^ x' (both 0). However, the former could appear with arguments of floating-point type, and we weren't checking for that. This started triggering an assert with r163069, which checks that a constant value is actually going to be used as an integer or pointer. llvm-svn: 163159
* Revert r163083 per chandlerc's request.Joao Matos2012-09-041-1/+0
| | | | llvm-svn: 163149
* Implemented parsing and AST support for the MS __leave exception statement. ↵Joao Matos2012-09-021-0/+1
| | | | | | Also a minor fix to __except printing in StmtPrinter.cpp. Thanks to Aaron Ballman for review. llvm-svn: 163083
* [analyzer] Silence unused variable warnings in NDEBUG builds.Jordan Rose2012-09-011-0/+2
| | | | | | No functionality change. llvm-svn: 163073
* [analyzer] Disallow creation of int vals with explicit bit width / signedness.Jordan Rose2012-09-011-5/+1
| | | | | | | | | | All clients of BasicValueFactory should be using QualTypes instead, and indeed it seems they are. This caught the (fortunately harmless) bug fixed in the previous commit. No intended functionality change. llvm-svn: 163069
* [analyzer] Don't attempt to create a floating-point value of "1" for ++/--.Jordan Rose2012-09-011-1/+3
| | | | | | | | | | | The current logic would actually create a float- or double-sized signed integer value of 1, which is not at all the same. No test because the value would be swallowed by an Unknown as soon as it gets added or subtracted to the original value, but it enables the cleanup in the next patch. llvm-svn: 163068
* [analyzer] Future-proofing r163012 (nameless functions and RetainCountChecker)Jordan Rose2012-09-011-4/+4
| | | | | | | | | Any future exceptions need to go INSIDE the test that checks if the IdentifierInfo is non-null! No functionality change. Thanks for the review, Ted. llvm-svn: 163067
* [analyzer] Treat all struct values as regions (even rvalues).Jordan Rose2012-09-012-3/+20
| | | | | | | | | | | | | | | | | This allows us to correctly symbolicate the fields of structs returned by value, as well as get the proper 'this' value for when methods are called on structs returned by value. This does require a moderately ugly hack in the StoreManager: if we assign a "struct value" to a struct region, that now appears as a Loc value being bound to a region of struct type. We handle this by simply "dereferencing" the struct value region, which should create a LazyCompoundVal. This should fix recent crashes analyzing LLVM and on our internal buildbot. <rdar://problem/12137950> llvm-svn: 163066
* [analyzer] Always derive a CallEvent's return type from its origin expr.Jordan Rose2012-09-014-125/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we preferred to get a result type by looking at the callee's declared result type. This allowed us to handlereferences, which are represented in the AST as lvalues of their pointee type. (That is, a call to a function returning 'int &' has type 'int' and value kind 'lvalue'.) However, this results in us preferring the original type of a function over a casted type. This is a problem when a function pointer is casted to another type, because the conjured result value will have the wrong type. AdjustedReturnValueChecker is supposed to handle this, but still doesn't handle the case where there is no "original function" at all, i.e. where the callee is unknown. Now, we instead look at the call expression's value kind (lvalue, xvalue, or prvalue), and adjust the expr's type accordingly. This will have no effect when the function is inlined, and will conjure the value that will actually be used when it is not. This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately, the cases where it would still be useful are where we need to cast the result of an inlined function or a checker-evaluated function, and in these cases we don't know what we're casting /from/ by the time we can do post- call checks. In light of that, remove AdjustedReturnValueChecker, which was already not checking quite a few calls. llvm-svn: 163065
* Split library clangRewrite into clangRewriteCore and clangRewriteFrontend.Ted Kremenek2012-09-013-4/+5
| | | | | | | This is similar to how we divide up the StaticAnalyzer libraries to separate core functionality to what is clearly associated with Frontend actions. llvm-svn: 163050
* [analyzer] RetainCountChecker: don't assume all functions have names.Jordan Rose2012-08-312-5/+10
| | | | | | | | | | | | | | | Fixes a hard-to-reach crash when calling a non-member overloaded operator with arguments that may be callbacks. Future-proofing: don't make the same assumption in MallocSizeofChecker. Aside from possibly respecting attributes in the future, it might be possible to call 'malloc' through a function pointer. I audited all other uses of FunctionDecl::getIdentifier() in the analyzer; they all now correctly test to see if the identifier is present before using it. llvm-svn: 163012
* [analyzer] Though C++ inlining is enabled, don't inline ctors and dtors.Jordan Rose2012-08-313-30/+63
| | | | | | | | | | | | | | | | More generally, this adds a new configuration option 'c++-inlining', which controls which C++ member functions can be considered for inlining. This uses the new -analyzer-config table, so the cc1 arguments will look like this: ... -analyzer-config c++-inlining=[none|methods|constructors|destructors] Note that each mode implies that all the previous member function kinds will be inlined as well; it doesn't make sense to inline destructors without inlining constructors, for example. The default mode is 'methods'. llvm-svn: 163004
* Make AnalyzerOptions a shared object between CompilerInvocation andTed Kremenek2012-08-312-18/+18
| | | | | | | AnalysisManager, allowing the StringMap of configuration values to be propagated. llvm-svn: 162978
* Move AnalyzerOptions.h into 'Core' StaticAnalyzer sub-library.Ted Kremenek2012-08-312-5/+5
| | | | llvm-svn: 162977
* [analyzer] Ensure that PathDiagnostics profile the same regardless of path.Jordan Rose2012-08-316-50/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | PathDiagnostics are actually profiled and uniqued independently of the path on which the bug occurred. This is used to merge diagnostics that refer to the same issue along different paths, as well as by the plist diagnostics to reference files created by the HTML diagnostics. However, there are two problems with the current implementation: 1) The bug description is included in the profile, but some PathDiagnosticConsumers prefer abbreviated descriptions and some prefer verbose descriptions. Fixed by including both descriptions in the PathDiagnostic objects and always using the verbose one in the profile. 2) The "minimal" path generation scheme provides extra information about which events came from macros that the "extensive" scheme does not. This resulted not only in different locations for the plist and HTML diagnostics, but also in diagnostics being uniqued in the plist output but not in the HTML output. Fixed by storing the "end path" location explicitly in the PathDiagnostic object, rather than trying to find the last piece of the path when the diagnostic is requested. This should hopefully finish unsticking our internal buildbot. llvm-svn: 162965
* [analyzer] Fix a crash in plist-html generation introduced in r162939.Jordan Rose2012-08-311-12/+13
| | | | | | | Basically, do the correct thing to fix the XML generation error, rather than making it even worse by unilaterally dereferencing a null pointer. llvm-svn: 162964
* Change the representation of builtin functions in the ASTEli Friedman2012-08-311-1/+2
| | | | | | | | | (__builtin_* etc.) so that it isn't possible to take their address. Specifically, introduce a new type to represent a reference to a builtin function, and a new cast kind to convert it to a function pointer in the operand of a call. Fixes PR13195. llvm-svn: 162962
* [analyzer] Refactor the logic that determines if a functions should beAnna Zaks2012-08-304-10/+26
| | | | | | | | | | | | reanalyzed. The policy on what to reanalyze should be in AnalysisConsumer with the rest of visitation order logic. There is no reason why ExprEngine needs to pass the Visited set to CoreEngine, it can populate it itself. llvm-svn: 162957
* [analyzer] Remove cast inside dyn_cast.Anna Zaks2012-08-301-1/+1
| | | | llvm-svn: 162951
* [analyzer] Fixup for r162935 as per Jordan's review.Anna Zaks2012-08-301-3/+3
| | | | | | Thanks for catching this! llvm-svn: 162949
* [analyzer] Plist diagnostics: Fix a case where we fail to close an XML tag.Jordan Rose2012-08-301-3/+2
| | | | | | | | | | If the current path diagnostic does /not/ have files associated with it, we were simply skipping on to the next diagnostic with 'continue'. But that also skipped the close tag for the diagnostic's <dict> node. Part of fixing our internal analyzer buildbot. llvm-svn: 162939
* [analyzer] Do not propagate the [super init] could be nil assumptionAnna Zaks2012-08-301-8/+32
| | | | | | | | from callee to caller. radar://12109638 llvm-svn: 162935
* Teach RetainCountChecker about 'pragma clang arc_cf_code_audited'.Ted Kremenek2012-08-301-0/+5
| | | | llvm-svn: 162934
* Rename 'MaxLoop' to 'maxBlockVisitOnPath' to reflect reality. WeTed Kremenek2012-08-301-1/+1
| | | | | | should consider renaming the command line option as well. llvm-svn: 162932
* Rename 'VisualizeEGUbi' and 'VisualizeEGDot' to ↵Ted Kremenek2012-08-301-2/+2
| | | | | | | | 'visualizeExplodedGraphWithUbigGraph' and 'visualizeExplodedGraphWithGraphViz' respectively. llvm-svn: 162931
* Rename AnalyzerOptions 'EagerlyAssume' to 'eagerlyAssumeBinOpBifurcation'.Ted Kremenek2012-08-302-12/+14
| | | | llvm-svn: 162930
* Store const& to AnalyzerOptions in AnalysisManager instead of copyingTed Kremenek2012-08-304-66/+34
| | | | | | individual flags. llvm-svn: 162929
* Move AnalyzerOptions.h to include/clang/StaticAnalyzer.Ted Kremenek2012-08-302-2/+2
| | | | llvm-svn: 162928
OpenPOWER on IntegriCloud