summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Relax assumption in FindLastStoreBRVisitor that the thing we are ↵Ted Kremenek2013-02-251-31/+34
| | | | | | | | | | | | looking for is always a VarRegion. This was triggering assertion failures when analyzing the LLVM codebase. This is fallout from r175988. I've got delta chewing away on a test case, but I wanted the fix to go in now. llvm-svn: 176011
* [analyzer] add the notion of an "interesting" lvalue expression for ↵Ted Kremenek2013-02-252-4/+16
| | | | | | | | | | ExplodedNode pruning. r175988 modified the ExplodedGraph trimming algorithm to retain all nodes for "lvalue" expressions. This patch refines that notion to only "interesting" expressions that would be used for diagnostics. llvm-svn: 176010
* [analyzer] tracking stores/constraints now works for ObjC ivars or struct ↵Ted Kremenek2013-02-244-19/+78
| | | | | | | | | | | | | | | | | | | | | | | fields. This required more changes than I originally expected: - ObjCIvarRegion implements "canPrintPretty" et al - DereferenceChecker indicates the null pointer source is an ivar - bugreporter::trackNullOrUndefValue() uses an alternate algorithm to compute the location region to track by scouring the ExplodedGraph. This allows us to get the actual MemRegion for variables, ivars, fields, etc. We only hand construct a VarRegion for C++ references. - ExplodedGraph no longer drops nodes for expressions that are marked 'lvalue'. This is to facilitate the logic in the previous bullet. This may lead to a slight increase in size in the ExplodedGraph, which I have not measured, but it is likely not to be a big deal. I have validated each of the changed plist output. Fixes <rdar://problem/12114812> llvm-svn: 175988
* Add "KnownSVal" to represent SVals that cannot be UnknownSVal.Ted Kremenek2013-02-242-17/+15
| | | | | | | This provides a few sundry cleanups, and allows us to provide a compile-time check for a case that was a runtime assertion. llvm-svn: 175987
* Remove the CFGElement "Invalid" state.David Blaikie2013-02-2310-30/+27
| | | | | | | | | | | | | Use Optional<CFG*> where invalid states were needed previously. In the one case where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy CFGAutomaticObjDtor. Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek and Doug Gregor. Post commit code review feedback on r175796 by Ted Kremenek. llvm-svn: 175938
* [analyzer] Don't canonicalize the RecordDecl used in CXXBaseObjectRegion.Jordan Rose2013-02-221-2/+2
| | | | | | | | | | | This Decl shouldn't be the canonical Decl; it should be the Decl used by the CXXBaseSpecifier in the subclass. Unfortunately, that means continuing to throw getCanonicalDecl() on all comparisons. This fixes MemRegion::getAsOffset's use of ASTRecordLayout when redeclarations are involved. llvm-svn: 175913
* [analyzer] Implement "Loop executed 0 times" diagnostic correctly.Ted Kremenek2013-02-221-20/+62
| | | | | | Fixes <rdar://problem/13236549> llvm-svn: 175863
* [analyzer] Place all inlining policy checks into one palceAnna Zaks2013-02-221-175/+179
| | | | | | | | | | | | | Previously, we had the decisions about inlining spread out over multiple functions. In addition to the refactor, this commit ensures that we will always inline BodyFarm functions as long as the Decl is available. This fixes false positives due to those functions not being inlined when no or minimal inlining is enabled such (as shallow mode). llvm-svn: 175857
* [analyzer] Make sure a materialized temporary matches its bindings.Jordan Rose2013-02-222-45/+38
| | | | | | | | | | | | | | | | | This is a follow-up to r175830, which made sure a temporary object region created for, say, a struct rvalue matched up with the initial bindings being stored into it. This does the same for the case in which the AST actually tells us that we need to create a temporary via a MaterializeObjectExpr. I've unified the two code paths and moved a static helper function onto ExprEngine. This also caused a bit of test churn, causing us to go back to describing temporary regions without a 'const' qualifier. This seems acceptable; it's our behavior from a few months ago. <rdar://problem/13265460> (part 2) llvm-svn: 175854
* Fix regression in modeling assignments of an address of a variable to ↵Ted Kremenek2013-02-221-3/+1
| | | | | | itself. Fixes <rdar://problem/13226577>. llvm-svn: 175852
* [analyzer] Fix buildbot by not reusing a variable name.Jordan Rose2013-02-221-4/+4
| | | | llvm-svn: 175848
* [analyzer] Make sure a temporary object region matches its initial bindings.Jordan Rose2013-02-211-4/+31
| | | | | | | | | | | | | | | | When creating a temporary region (say, when a struct rvalue is used as the base of a member expr), make sure we account for any derived-to-base casts. We don't actually record these in the LazyCompoundVal that represents the rvalue, but we need to make sure that the temporary region we're creating (a) matches the bindings, and (b) matches its expression. Most of the time this will do exactly the same thing as before, but it fixes spurious "garbage value" warnings introduced in r175234 by the use of lazy bindings to model trivial copy constructors. <rdar://problem/13265460> llvm-svn: 175830
* Simplify code to use castAs rather than getAs + assert.David Blaikie2013-02-211-3/+2
| | | | | | Post commit review feedback on r175812 from Jordan Rose. llvm-svn: 175826
* Add back implicitly dropped const.David Blaikie2013-02-211-1/+1
| | | | | | | (found due to incoming improvements to llvm::cast machinery that will error on this sort of mistake) llvm-svn: 175817
* Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie2013-02-2118-125/+117
| | | | | | See r175462 for another example/more details. llvm-svn: 175812
* Replace CFGElement llvm::cast support to be well-defined.David Blaikie2013-02-2110-35/+36
| | | | | | See r175462 for another example/more details. llvm-svn: 175796
* Avoid implicit conversions of Optional<T> to bool.David Blaikie2013-02-211-1/+1
| | | | | | | This is a precursor to making Optional<T>'s operator bool 'explicit' when building Clang & LLVM as C++11. llvm-svn: 175722
* StaticAnalyzer/Core: Suppress warnings. [-Wunused-variable, -Wunused-function]NAKAMURA Takumi2013-02-211-2/+3
| | | | llvm-svn: 175721
* Whitespace.NAKAMURA Takumi2013-02-211-1/+1
| | | | llvm-svn: 175720
* [analyzer] Record whether a base object region represents a virtual base.Jordan Rose2013-02-214-50/+65
| | | | | | | | | This allows MemRegion and MemRegionManager to avoid asking over and over again whether an class is a virtual base or a non-virtual base. Minor optimization/cleanup; no functionality change. llvm-svn: 175716
* [analyzer] Tidy up a few uses of Optional in RegionStore.Jordan Rose2013-02-211-10/+7
| | | | | | | | | Some that I just added needed conversion to use 'None', others looked better using Optional<SVal>::create. No functionality change. llvm-svn: 175714
* Use None rather than Optional<T>() where possible.David Blaikie2013-02-213-11/+11
| | | | llvm-svn: 175705
* [analyzer] Tighten up safety in the use of lazy bindings.Jordan Rose2013-02-211-71/+79
| | | | | | | | | | | | | | | - When deciding if we can reuse a lazy binding, make sure to check if there are additional bindings in the sub-region. - When reading from a lazy binding, don't accidentally strip off casts or base object regions. This slows down lazy binding reading a bit but is necessary for type sanity when treating one class as another. A bit of minor refactoring allowed these two checks to be unified in a nice early-return-using helper function. <rdar://problem/13239840> llvm-svn: 175703
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-2031-178/+146
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Remove redundant Optional type in favor of llvm::OptionalDavid Blaikie2013-02-201-24/+4
| | | | llvm-svn: 175678
* Use op-> directly rather than via Optional<T>::getPointer.David Blaikie2013-02-201-2/+2
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175677
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-2040-422/+444
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* [analyzer] Account for the "interesting values" hash table resizing.Jordan Rose2013-02-201-3/+3
| | | | | | | | | | | RegionStoreManager::getInterestingValues() returns a pointer to a std::vector that lives inside a DenseMap, which is constructed on demand. However, constructing one such value can lead to constructing another value, which will invalidate the reference created earlier. Fixed by delaying the new entry creation until the function returns. llvm-svn: 175582
* [analyzer] Don't accidentally strip off base object regions for lazy bindings.Jordan Rose2013-02-191-21/+43
| | | | | | | | | | | | If a base object is at a 0 offset, RegionStoreManager may find a lazy binding for the entire object, then try to attach a FieldRegion or grandparent CXXBaseObjectRegion on top of that (skipping the intermediate region). We now preserve as many layers of base object regions necessary to make the types match. <rdar://problem/13239840> llvm-svn: 175556
* Disable dead stores checker for template instantations. Fixes ↵Ted Kremenek2013-02-181-0/+9
| | | | | | <rdar://problem/13213575>. llvm-svn: 175425
* [analyzer] Don't assert when mixing reinterpret_cast and derived-to-base casts.Jordan Rose2013-02-151-0/+25
| | | | | | | | | | | | | | | This just adds a very simple check that if a DerivedToBase CastExpr is operating on a value with known C++ object type, and that type is not the base type specified in the AST, then the cast is invalid and we should return UnknownVal. In the future, perhaps we can have a checker that specifies that this is illegal, but we still shouldn't assert even if the user turns that checker off. PR14872 llvm-svn: 175239
* Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."Jordan Rose2013-02-152-14/+75
| | | | | | | | | | | | | | ...after a host of optimizations related to the use of LazyCompoundVals (our implementation of aggregate binds). Originally applied in r173951. Reverted in r174069 because it was causing hangs. Re-applied in r174212. Reverted in r174265 because it was /still/ causing hangs. If this needs to be reverted again it will be punted to far in the future. llvm-svn: 175234
* [analyzer] Cache the bindings accessible through a LazyCompoundVal.Jordan Rose2013-02-151-30/+68
| | | | | | | This means we don't have to recompute them all later for every removeDeadSymbols check. llvm-svn: 175233
* [analyzer] Scan the correct store when finding symbols in a LazyCompoundVal.Jordan Rose2013-02-151-2/+10
| | | | | | | | Previously, we were scanning the current store. Now, we properly scan the store that the LazyCompoundVal came from, which may have very different live symbols. llvm-svn: 175232
* [analyzer] Tweak LazyCompoundVal reuse check to ignore qualifiers.Jordan Rose2013-02-151-1/+1
| | | | | | This is optimization only; no behavioral change. llvm-svn: 175231
* [analyzer] Use collectSubRegionKeys to make removeDeadBindings faster.Jordan Rose2013-02-151-19/+33
| | | | | | | | | | | Previously, whenever we had a LazyCompoundVal, we crawled through the entire store snapshot looking for bindings within the LCV's region. Now, we just ask for the subregion bindings of the lazy region and only visit those. This is an optimization (so no test case), but it may allow us to clean up more dead bindings than we were previously. llvm-svn: 175230
* [analyzer] Refactor RegionStore's sub-region bindings traversal.Jordan Rose2013-02-152-46/+82
| | | | | | | | | | | This is going to be used in the next commit. While I'm here, tighten up assumptions about symbolic offset BindingKeys, and make offset calculation explicitly handle all MemRegion kinds. No functionality change. llvm-svn: 175228
* objective-C: synthesize properties in order of theirFariborz Jahanian2013-02-141-1/+2
| | | | | | | | declarations to synthesize their ivars in similar determinstic order so they are laid out in a determinstic order. // rdar://13192366 llvm-svn: 175214
* [analyzer] Try constant-evaluation for all variables, not just globals.Jordan Rose2013-02-141-21/+34
| | | | | | | | | | | | | | | | | | | | | In C++, constants captured by lambdas (and blocks) are not actually stored in the closure object, since they can be expanded at compile time. In this case, they will have no binding when we go to look them up. Previously, RegionStore thought they were uninitialized stack variables; now, it checks to see if they are a constant we know how to evaluate, using the same logic as r175026. This particular code path is only for scalar variables. Constant arrays and structs are still unfortunately unhandled; we'll need a stronger solution for those. This may have a small performance impact, but only for truly-undefined local variables, captures in a non-inlined block, and non-constant globals. Even then, in the non-constant case we're only doing a quick type check. <rdar://problem/13105553> llvm-svn: 175194
* [analyzer] Use Clang's evaluation for global constants and default arguments.Jordan Rose2013-02-133-10/+41
| | | | | | | | | | | Previously, we were handling only simple integer constants for globals and the smattering of implicitly-valued expressions handled by Environment for default arguments. Now, we can use any integer constant expression that Clang can evaluate, in addition to everything we handled before. PR15094 / <rdar://problem/12830437> llvm-svn: 175026
* [analyzer] Use makeZeroVal in RegionStore's lazy evaluation of statics.Jordan Rose2013-02-131-23/+19
| | | | | | No functionality change. llvm-svn: 175025
* Remove some stray uses of <ctype.h> functions.Jordan Rose2013-02-091-1/+2
| | | | | | These are causing assertions on some MSVC builds. llvm-svn: 174805
* clang/lib/StaticAnalyzer/Core/BugReporter.cpp: Appease old msvc in ↵NAKAMURA Takumi2013-02-091-1/+2
| | | | | | std::pair(0, 0). llvm-svn: 174792
* [analyzer] Invalidation checker: move the "missing implementation" checkAnna Zaks2013-02-091-12/+13
| | | | | | | | | | | | The missing definition check should be in the same category as the missing ivar validation - in this case, the intent is to invalidate in the given class, as described in the declaration, but the implementation does not perform the invalidation. Whereas the MissingInvalidationMethod checker checks the cases where the method intention is not to invalidate. The second checker has potential to have a much higher false positive rate. llvm-svn: 174787
* [analyzer] Move DefaultBool so that all checkers can share it.Anna Zaks2013-02-082-14/+0
| | | | llvm-svn: 174782
* [analyzer] Split IvarInvalidation into two checkersAnna Zaks2013-02-082-45/+91
| | | | | | | Separate the checking for the missing invalidation methods into a separate checker so that it can be turned on/off independently. llvm-svn: 174781
* [analyzer] IvarInvalidation: refactor, pull out the diagnostic printingAnna Zaks2013-02-081-49/+69
| | | | llvm-svn: 174780
* [analyzer] IvarInvalidation: add annotation for partial invalidationAnna Zaks2013-02-081-39/+78
| | | | | | | | | | | The new annotation allows having methods that only partially invalidate IVars and might not be called from the invalidation methods directly (instead, are guaranteed to be called before the invalidation occurs). The checker is going to trust the programmer to call the partial invalidation method before the invalidator.This is common in cases when partial object tear down happens before the death of the object. llvm-svn: 174779
* Teach BugReporter (extensive diagnostics) to emit a diagnostic when a loop ↵Ted Kremenek2013-02-081-3/+51
| | | | | | | | body is skipped. Fixes <rdar://problem/12322528>. llvm-svn: 174736
* Remove stale instance variable.Ted Kremenek2013-02-081-1/+0
| | | | llvm-svn: 174730
OpenPOWER on IntegriCloud