summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* Forgot some references to misspelled enums.Benjamin Kramer2013-10-201-4/+4
| | | | llvm-svn: 193047
* Miscellaneous speling fixes.Benjamin Kramer2013-10-201-1/+1
| | | | llvm-svn: 193046
* [analyzer] Don't draw edges to C++11 in-class member initializers.Jordan Rose2013-10-161-2/+38
| | | | | | | | | | | Since these aren't lexically in the constructor, drawing arrows would be a horrible jump across the body of the class. We could still do better here by skipping over unimportant initializers, but this at least keeps everything within the body of the constructor. <rdar://problem/14960554> llvm-svn: 192818
* [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.Jordan Rose2013-10-078-34/+23
| | | | | | No functionality change. llvm-svn: 192114
* [analyzer] RetainCountChecker: add support for CFAutorelease.Jordan Rose2013-10-071-8/+22
| | | | | | <rdar://problems/13710586&13710643> llvm-svn: 192113
* [analyzer] Replace bug category magic strings with shared constants, take 2.Jordan Rose2013-10-047-12/+14
| | | | | | | Re-commit r191910 (reverted in r191936) with layering violation fixed, by moving the bug categories to StaticAnalyzerCore instead of ...Checkers. llvm-svn: 191937
* Temporarily revert r191910 until the layering violation can be fixed.Richard Smith2013-10-033-6/+5
| | | | llvm-svn: 191936
* [analyzer] Replace bug category magic strings with shared constants.Jordan Rose2013-10-033-5/+6
| | | | | | | | | | One small functionality change is to bring the sizeof-pointer checker in line with the other checkers by making its category be "Logic error" instead of just "Logic". There should be no other functionality changes. Patch by Daniel Marjamäki! llvm-svn: 191910
* [analyzer] Add new debug helper clang_analyzer_warnIfReached.Jordan Rose2013-10-031-0/+13
| | | | | | | | | | | | | This will emit a warning if a call to clang_analyzer_warnIfReached is executed, printing REACHABLE. This is a more explicit way to declare expected reachability than using clang_analyzer_eval or triggering a bug (divide-by-zero or null dereference), and unlike the former will work the same in inlined functions and top-level functions. Like the other debug helpers, it is part of the debug.ExprInspection checker. Patch by Jared Grubb! llvm-svn: 191909
* [analyzer] Add missing return after function pointer null check.Jordan Rose2013-10-021-0/+1
| | | | | | | | | | | | | | | | | Also add some tests that there is actually a message and that the bug is actually a hard error. This actually behaved correctly before, because: - addTransition() doesn't actually add a transition if the new state is null; it assumes you want to propagate the predecessor forward and does nothing. - generateSink() is called in order to emit a bug report. - If at least one new node has been generated, the predecessor node is /not/ propagated forward. But now it's spelled out explicitly. Found by Richard Mazorodze, who's working on a patch that may require this. llvm-svn: 191805
* [analyzer] Make inlining decisions based on the callee being variadic.Jordan Rose2013-09-282-4/+17
| | | | | | | | | | | | ...rather than trying to figure it out from the call site, and having people complain that we guessed wrong and that a prototype-less call is the same as a variadic call on their system. More importantly, fix a crash when there's no decl at the call site (though we could have just returned a default value). <rdar://problem/15037033> llvm-svn: 191599
* [analyzer] Allow pre/post-statement checkers for UnaryOperator.Jordan Rose2013-09-271-20/+30
| | | | | | Found by Arthur Yoo. llvm-svn: 191532
* [analyzer] Handle destructors for the argument to C++ 'delete'.Jordan Rose2013-09-254-3/+31
| | | | | | | | | | | | | | | | | Now that the CFG includes nodes for the destructors in a delete-expression, process them in the analyzer using the same common destructor interface currently used for local, member, and base destructors. Also, check for when the value is known to be null, in which case no destructor is actually run. This does not yet handle destructors for deleted /arrays/, which may need more CFG work. It also causes a slight regression in the location of double delete warnings; the double delete is detected at the destructor call, which is implicit, and so is reported on the first access within the destructor instead of at the 'delete' statement. This will be fixed soon. Patch by Karthik Bhat! llvm-svn: 191381
* StaticAnalyzer/Core/RegionStore.cpp: Prune one last "\param IsConst", as ↵NAKAMURA Takumi2013-09-251-2/+0
| | | | | | fixup to r191342. [-Wdocumentation] llvm-svn: 191360
* [analyzer] This patch removes passing around of const-invalidation vs ↵Anton Yartsev2013-09-246-131/+133
| | | | | | | | | | regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future. With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters. This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker. llvm-svn: 191342
* Fix array_pod_sort predicates after LLVM change.Benjamin Kramer2013-09-221-3/+3
| | | | llvm-svn: 191176
* array_pod_sort loses some type safety, better use the right types.Benjamin Kramer2013-09-221-2/+2
| | | | llvm-svn: 191174
* Rewrite a cold use of std::sort to array_pod_sort.Benjamin Kramer2013-09-221-12/+16
| | | | | | No functionality change. llvm-svn: 191173
* [analyzer] Use getParentIgnoreParenCasts instead of doing it by hand.Jordan Rose2013-09-201-3/+1
| | | | | | | | | | | | Apart from being more compact and already implemented, this also handles the case where the parent is null. (It does also ignore all casts, not just implicit ones, but this is more efficient to test and in the case we care about---a message in a PseudoObjectExpr---there should only be implicit casts anyway. This should fix our internal buildbot. llvm-svn: 191094
* [analyzer] Don't even try to convert floats to booleans for now.Jordan Rose2013-09-181-0/+4
| | | | | | | | | | | We now have symbols with floating-point type to make sure that (double)x == (double)x comes out true, but we still can't do much with these. For now, don't even bother trying to create a floating-point zero value; just give up on conversion to bool. PR14634, C++ edition. llvm-svn: 190953
* Add the intrinsic __builtin_convertvectorHal Finkel2013-09-181-0/+1
| | | | | | | | | | | | | | | | | | LLVM supports applying conversion instructions to vectors of the same number of elements (fptrunc, fptosi, etc.) but there had been no way for a Clang user to cause such instructions to be generated when using builtin vector types. C-style casting on vectors is already defined in terms of bitcasts, and so cannot be used for these conversions as well (without leading to a very confusing set of semantics). As a result, this adds a __builtin_convertvector intrinsic (patterned after the OpenCL __builtin_astype intrinsic). This is intended to aid the creation of vector intrinsic headers that create generic IR instead of target-dependent intrinsics (in other words, this is a generic _mm_cvtepi32_ps). As noted in the documentation, the action of __builtin_convertvector is defined in terms of the action of a C-style cast on each vector element. llvm-svn: 190915
* [analyzer] More reliably detect property accessors.Anna Zaks2013-09-171-0/+6
| | | | | | | | | This has a side effect of preventing a crash, which occurs because we get a property getter declaration, which is overriding but is declared inside @protocol. Will file a bug about this inconsistency internally. Getting a small test case is very challenging. llvm-svn: 190836
* [analyzer] Stop tracking the objects with attribute cleanup in the ↵Anna Zaks2013-09-171-0/+10
| | | | | | | | RetainCountChecker. This suppresses false positive leaks. We stop tracking a value if it is assigned to a variable declared with a cleanup attribute. llvm-svn: 190835
* New message for cases when ownership is taken:Anton Yartsev2013-09-161-10/+23
| | | | | | | | "+method_name: cannot take ownership of memory allocated by 'new'." instead of the old "Memory allocated by 'new' should be deallocated by 'delete', not +method_name" llvm-svn: 190800
* Clean up some Triple usage in clang.Cameron Esfahani2013-09-141-2/+1
| | | | llvm-svn: 190737
* Fix two incorrect comments.Jordan Rose2013-09-131-2/+2
| | | | | | Patch by Jared Grubb! llvm-svn: 190652
* [analyzer] Run post-stmt checks for DeclStmt.Jordan Rose2013-09-131-1/+4
| | | | | | | | | No tests because no in-tree checkers use this, but that shouldn't stop out-of-tree checkers. Found by Aemon Cannon! llvm-svn: 190650
* [analyzer] Handle zeroing constructors for fields of structs with empty bases.Jordan Rose2013-09-111-4/+13
| | | | | | | | | | | | | | | | | | | RegionStore tries to protect against accidentally initializing the same region twice, but it doesn't take subregions into account very well. If the outer region being initialized is a struct with an empty base class, the offset of the first field in the struct will be 0. When we initialize the base class, we may invalidate the contents of the struct by providing a default value of Unknown (or some new symbol). We then go to initialize the member with a zeroing constructor, only to find that the region at that offset in the struct already has a value. The best we can do here is to invalidate that value and continue; neither the old default value nor the new 0 is correct for the entire struct after the member constructor call. The correct solution for this is to track region extents in the store. <rdar://problem/14914316> llvm-svn: 190530
* Get rid of unused isPodLike definition.Eli Friedman2013-09-111-2/+0
| | | | llvm-svn: 190463
* Switched FormatAttr to using an IdentifierArgument instead of a ↵Aaron Ballman2013-09-031-1/+2
| | | | | | StringArgument since that is a more accurate modeling. llvm-svn: 189851
* Add an implicit dtor CFG node just before C++ 'delete' expressions.Jordan Rose2013-09-032-0/+13
| | | | | | | | | | | | | | This paves the way for adding support for modeling the destructor of a region before it is deleted. The statement "delete <expr>" now generates this series of CFG elements: 1. <expr> 2. [B1.1]->~Foo() (Implicit destructor) 3. delete [B1.1] Patch by Karthik Bhat! llvm-svn: 189828
* [analyzer] Add very limited support for temporary destructorsPavel Labath2013-09-023-5/+31
| | | | | | | | | | | | | | | | | | | | | This is an improved version of r186498. It enables ExprEngine to reason about temporary object destructors. However, these destructor calls are never inlined, since this feature is still broken. Still, this is sufficient to properly handle noreturn temporary destructors. Now, the analyzer correctly handles expressions like "a || A()", and executes the destructor of "A" only on the paths where "a" evaluted to false. Temporary destructor processing is still off by default and one has to explicitly request it by setting cfg-temporary-dtors=true. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1259 llvm-svn: 189746
* [analyzer] Treat the rvalue of a forward-declared struct as Unknown.Jordan Rose2013-08-301-1/+1
| | | | | | | | | | This will never happen in the analyzed code code, but can happen for checkers that over-eagerly dereference pointers without checking that it's safe. UnknownVal is a harmless enough value to get back. Fixes an issue added in r189590, caught by our internal buildbot. llvm-svn: 189688
* [analyzer] Fix handling of "empty" structs with base classesPavel Labath2013-08-291-1/+9
| | | | | | | | | | | | | | | | | | | Summary: RegionStoreManager had an optimization which replaces references to empty structs with UnknownVal. Unfortunately, this check didn't take into account possible field members in base classes. To address this, I changed this test to "is empty and has no base classes". I don't consider it worth the trouble to go through base classes and check if all of them are empty. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1547 llvm-svn: 189590
* [analyzer] Add support for testing the presence of weak functions.Jordan Rose2013-08-285-67/+57
| | | | | | | | | | | | | | | | | | | | | | | | When casting the address of a FunctionTextRegion to bool, or when adding constraints to such an address, use a stand-in symbol to represent the presence or absence of the function if the function is weakly linked. This is groundwork for possible simple availability testing checks, and can already catch mistakes involving inverted null checks for weakly-linked functions. Currently, the implementation reuses the "extent" symbols, originally created for tracking the size of a malloc region. Since FunctionTextRegions cannot be dereferenced, the extent symbol will never be used for anything else. Still, this probably deserves a refactoring in the future. This patch does not attempt to support testing the presence of weak /variables/ (global variables), which would likely require much more of a change and a generalization of "region structure metadata", like the current "extents", vs. "region contents metadata", like CStringChecker's "string length". Patch by Richard <tarka.t.otter@googlemail.com>! llvm-svn: 189492
* [analyzer] Assume new returns non-null even under -fno-exceptionsPavel Labath2013-08-281-4/+7
| | | | | | | | | | | | | | | | | | Summary: -fno-exceptions does not implicitly attach a nothrow specifier to every operator new. Even in this mode, non-nothrow new must not return a null pointer. Failure to allocate memory can be signalled by other means, or just by killing the program. This behaviour is consistent with the compiler - even with -fno-exceptions, the generated code never tests for null (and would segfault if the opeator actually happened to return null). Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1528 llvm-svn: 189452
* Use pop_back_val() instead of both back() and pop_back().Robert Wilhelm2013-08-236-22/+14
| | | | | | No functionality change intended. llvm-svn: 189112
* [analyzer] Refactor conditional expression evaluating codePavel Labath2013-08-232-64/+70
| | | | | | | | | | | | | | | | | | | Summary: Instead of digging through the ExplodedGraph, to figure out which edge brought us here, I compute the value of conditional expression by looking at the sub-expression values. To do this, I needed to change the liveness algorithm a bit -- now, the full conditional expression also depends on all atomic sub-expressions, not only the outermost ones. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1340 llvm-svn: 189090
* Split isFromMainFile into two functions.Eli Friedman2013-08-225-7/+7
| | | | | | | | | Basically, isInMainFile considers line markers, and isWrittenInMainFile doesn't. Distinguishing between the two is useful when dealing with files which are preprocessed files or rewritten with -frewrite-includes (so we don't, for example, print useless warnings). llvm-svn: 188968
* [analyzer] Don't run unreachable code checker on inlined functions.Jordan Rose2013-08-191-0/+3
| | | | | | | | | This is still an alpha checker, but we use it in certain tests to make sure something is not being executed. This should fix the buildbots. llvm-svn: 188682
* [analyzer] Assume that strings are no longer than SIZE_MAX/4.Jordan Rose2013-08-191-2/+15
| | | | | | | | | This keeps the analyzer from making silly assumptions, like thinking strlen(foo)+1 could wrap around to 0. This fixes PR16558. Patch by Karthik Bhat! llvm-svn: 188680
* Omit arguments of __builtin_object_size from the CFG.Jordan Rose2013-08-191-6/+19
| | | | | | | | | | | | | | | | | This builtin does not actually evaluate its arguments for side effects, so we shouldn't include them in the CFG. In the analyzer, rely on the constant expression evaluator to get the proper semantics, at least for now. (In the future, we could get ambitious and try to provide path- sensitive size values.) In theory, this does pose a problem for liveness analysis: a variable can be used within the __builtin_object_size argument expression but not show up as live. However, it is very unlikely that such a value would be used to compute the object size and not used to access the object in some way. <rdar://problem/14760817> llvm-svn: 188679
* [analyzer] Fix inefficiency in dead symbol removalPavel Labath2013-08-191-17/+19
| | | | | | | | | | | | | | | | | Summary: ScanReachableSymbols uses a "visited" set to avoid scanning the same object twice. However, it did not use the optimization for LazyCompoundVal objects, which resulted in exponential complexity for long chains of temporary objects. Adding this resulted in a decrease of analysis time from >3h to 3 seconds for some files. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1398 llvm-svn: 188677
* Use the number of parameters in the actual method or function to determine ↵Ted Kremenek2013-08-161-7/+1
| | | | | | the CallEffects size. llvm-svn: 188587
* RetainCountChecker: Replace some loops with std:: algorithms.Benjamin Kramer2013-08-161-17/+5
| | | | llvm-svn: 188581
* Replace some DenseMap keys with simpler structures that don't need another ↵Benjamin Kramer2013-08-161-18/+14
| | | | | | DenseMapInfo specialization. llvm-svn: 188580
* Revert r188574. Turns out it isn't needed.Ted Kremenek2013-08-161-1/+0
| | | | llvm-svn: 188578
* Need summary info. about arguments toFariborz Jahanian2013-08-161-0/+1
| | | | | | CF functions coming from static analyzer API. llvm-svn: 188574
* [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.Jordan Rose2013-08-164-93/+55
| | | | | | | | | | | | | | | | | | | | This once again restores notes to following their associated warnings in -analyzer-output=text mode. (This is still only intended for use as a debugging aid.) One twist is that the warning locations in "regular" analysis output modes (plist, multi-file-plist, html, and plist-html) are reported at a different location on the command line than in the output file, since the command line has no path context. This commit makes -analyzer-output=text behave like a normal output format, which means that the *command line output will be different* in -analyzer-text mode. Again, since -analyzer-text is a debugging aid and lo-fi stand-in for a regular output mode, this change makes sense. Along the way, remove a few pieces of stale code related to the path diagnostic consumers. llvm-svn: 188514
* [analyzer] If realloc fails on an escaped region, that region doesn't leak.Jordan Rose2013-08-151-1/+1
| | | | | | | | | | | | | | | | | | When a region is realloc()ed, MallocChecker records whether it was known to be allocated or not. If it is, and the reallocation fails, the original region has to be freed. Previously, when an allocated region escaped, MallocChecker completely stopped tracking it, so a failed reallocation still (correctly) wouldn't require freeing the original region. Recently, however, MallocChecker started tracking escaped symbols, so that if it were freed we could check that the deallocator matched the allocator. This broke the reallocation model for whether or not a symbol was allocated. Now, MallocChecker will actually check if a symbol is owned, and only require freeing after a failed reallocation if it was owned before. PR16730 llvm-svn: 188468
OpenPOWER on IntegriCloud