summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [StaticAnalyzer] LoopUnrolling: Keep track the maximum number of steps for ↵Peter Szecsi2017-08-282-31/+57
| | | | | | | | | | | | each loop This way the unrolling can be restricted for loops which will take at most a given number of steps. It is defined as 128 in this patch and it seems to have a good number for that purpose. Differential Revision: https://reviews.llvm.org/D37181 llvm-svn: 311883
* [StaticAnalyzer] LoopUnrolling: Excluding loops which splits the statePeter Szecsi2017-08-281-1/+26
| | | | | | | | | | Added check if the execution of the last step of the given unrolled loop has generated more branches. If yes, than treat it as a normal (non-unrolled) loop in the remaining part of the analysis. Differential Revision: https://reviews.llvm.org/D36962 llvm-svn: 311881
* [StaticAnalyzer] LoopUnrolling fixesPeter Szecsi2017-08-283-12/+10
| | | | | | | | | | | | | | 1. The LoopUnrolling feature needs the LoopExit included in the CFG so added this dependency via the config options 2. The LoopExit element can be encountered even if we haven't encountered the block of the corresponding LoopStmt. So the asserts were not right. 3. If we are caching out the Node then we get a nullptr from generateNode which case was not handled. Differential Revision: https://reviews.llvm.org/D37103 llvm-svn: 311880
* [analyzer][GSoC] Re-implemente current virtual calls checker in a ↵Gabor Horvath2017-08-281-230/+223
| | | | | | | | | | path-sensitive way Patch by: Xin Wang Differential Revision: https://reviews.llvm.org/D34275 llvm-svn: 311877
* [StaticAnalyzer] LoopUnrolling: Track a LoopStack in order to completely ↵Peter Szecsi2017-08-212-96/+82
| | | | | | | | | | | | | unroll specific loops The LoopExit CFG information provides the opportunity to not mark the loops but having a stack which tracks if a loop is unrolled or not. So in case of simulating a loop we just add it and the information if it meets the requirements to be unrolled to the top of the stack. Differential Revision: https://reviews.llvm.org/D35684 llvm-svn: 311346
* [StaticAnalyzer] Handle LoopExit CFGElement in the analyzerPeter Szecsi2017-08-212-3/+28
| | | | | | | | | | This patch adds handling of the LoopExit CFGElements to the StaticAnalyzer. This is reached by introducing a new ProgramPoint. Tests will be added in a following commit. Differential Revision: https://reviews.llvm.org/D35670 llvm-svn: 311344
* [CFG] Add LoopExit information to CFGPeter Szecsi2017-08-194-2/+11
| | | | | | | | | | | | | | | | This patch introduces a new CFG element CFGLoopExit that indicate when a loop ends. It does not deal with returnStmts yet (left it as a TODO). It hidden behind a new analyzer-config flag called cfg-loopexit (false by default). Test cases added. The main purpose of this patch right know is to make loop unrolling and loop widening easier and more efficient. However, this information can be useful for future improvements in the StaticAnalyzer core too. Differential Revision: https://reviews.llvm.org/D35668 llvm-svn: 311235
* [StaticAnalyzer] LoopUnrolling: Exclude cases where the counter is escaped ↵Peter Szecsi2017-08-192-37/+84
| | | | | | | | | | | before the loop Adding escape check for the counter variable of the loop. It is achieved by jumping back on the ExplodedGraph to its declStmt. Differential Revision: https://reviews.llvm.org/D35657 llvm-svn: 311234
* [analyzer] Fix modeling of constructorsAlexander Shaposhnikov2017-08-181-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | This diff fixes analyzer's crash (triggered assert) on the newly added test case. The assert being discussed is assert(!B.lookup(R, BindingKey::Direct)) in lib/StaticAnalyzer/Core/RegionStore.cpp, however the root cause is different. For classes with empty bases the offsets might be tricky. For example, let's assume we have struct S: NonEmptyBase, EmptyBase { ... }; In this case Clang applies empty base class optimization and the offset of EmptyBase will be 0, it can be verified via clang -cc1 -x c++ -v -fdump-record-layouts main.cpp -emit-llvm -o /dev/null. When the analyzer tries to perform zero initialization of EmptyBase it will hit the assert because that region has already been "written" by the constructor of NonEmptyBase. Test plan: make check-all Differential revision: https://reviews.llvm.org/D36851 llvm-svn: 311182
* [analyzer] Add support for reference counting of parameters on the callee sideDevin Coughlin2017-08-171-9/+90
| | | | | | | | | | | | | | | This commit adds the functionality of performing reference counting on the callee side for Integer Set Library (ISL) to Clang Static Analyzer's RetainCountChecker. Reference counting on the callee side can be extensively used to perform debugging within a function (For example: Finding leaks on error paths). Patch by Malhar Thakkar! Differential Revision: https://reviews.llvm.org/D36441 llvm-svn: 311063
* [analyzer] Fix SimpleSValBuilder::simplifySValAlexander Shaposhnikov2017-08-141-1/+2
| | | | | | | | | | This diff fixes a crash (triggered assert) on the newly added test case. In the method Simplifier::VisitSymbolData we check the type of S and return Loc/NonLoc accordingly. Differential revision: https://reviews.llvm.org/D36564 llvm-svn: 310887
* [analyzer] Rename functions responsible for CFG-based suppress-on-sink.Artem Dergachev2017-08-141-13/+21
| | | | | | | | | Update comments. No functional change intended. Addresses Devin's post-commit review comments in https://reviews.llvm.org/D35673 and https://reviews.llvm.org/D35674. llvm-svn: 310820
* [Analyzer] Add support for displaying cross-file diagnostic paths in HTML outputDevin Coughlin2017-08-031-105/+209
| | | | | | | | | | | This change adds support for cross-file diagnostic paths in html output. If the diagnostic path is not cross-file, there is no change in the output. Patch by Vlad Tsyrklevich! Differential Revision: https://reviews.llvm.org/D30406 llvm-svn: 309968
* [StaticAnalyzer] Fix false positives for unreachable code in macros.Daniel Marjamaki2017-08-021-1/+1
| | | | | | | | | | | | | Example: #define MACRO(C) if (C) { static int x; .. } void foo() { MACRO(0); } Differential Revision: https://reviews.llvm.org/D36141 llvm-svn: 309799
* [StaticAnalyzer] LoopUnrolling - Attempt #2 to fix a crash in r309006.Peter Szecsi2017-07-251-2/+2
| | | | llvm-svn: 309061
* [StaticAnalyzer] LoopUnrolling - Attempt to fix a crash in r309006.Peter Szecsi2017-07-251-1/+3
| | | | llvm-svn: 309036
* [StaticAnalyzer] Completely unrolling specific loops with known bound optionPeter Szecsi2017-07-255-0/+238
| | | | | | | | | | | | | | | | | This feature allows the analyzer to consider loops to completely unroll. New requirements/rules (for unrolling) can be added easily via ASTMatchers. Right now it is hidden behind a flag, the aim is to find the correct heuristic and create a solution which results higher coverage % and more precise analysis, thus can be enabled by default. Right now the blocks which belong to an unrolled loop are marked by the LoopVisitor which adds them to the ProgramState. Then whenever we encounter a CFGBlock in the processCFGBlockEntrance which is marked then we skip its investigating. That means, it won't be considered to be visited more than the maximal bound for visiting since it won't be checked. llvm-svn: 309006
* [analyzer] Add diagnostic text for generalized refcount annotations.Devin Coughlin2017-07-251-11/+13
| | | | | | | | | | | | | | | Add a 'Generalized' object kind to the retain-count checker and suitable generic diagnostic text for retain-count diagnostics involving those objects. For now the object kind is introduced in summaries by 'annotate' attributes. Once we have more experience with these annotations we will propose explicit attributes. Patch by Malhar Thakkar! Differential Revision: https://reviews.llvm.org/D35613 llvm-svn: 308990
* [analyzer] Treat throws as sinks for suppress-on-sink purposes.Artem Dergachev2017-07-251-2/+23
| | | | | | | | | | | | | Because since r308957 the suppress-on-sink feature contains its own mini-analysis, it also needs to become aware that C++ unhandled exceptions cause sinks. Unfortunately, for now we treat all exceptions as unhandled in the analyzer, so suppress-on-sink needs to do the same. rdar://problem/28157554 Differential Revision: https://reviews.llvm.org/D35674 llvm-svn: 308961
* [analyzer] Further improve suppress-on-sink behavior in incomplete analyses.Artem Dergachev2017-07-251-3/+41
| | | | | | | | | | | | | | | | | | | | | If a certain memory leak (or other similar bug) found by the analyzer is known to be happening only before abnormal termination of the program ("sink", eg. assertion failure in the code under analysis, or another bug that introduces undefined behavior), such leak warning is discarded. However, if the analysis has never reaches completion (due to complexity of the code), it may be failing to notice the sink. This commit further extends the partial solution introduced in r290341 to cover cases when a complicated control flow occurs before encountering a no-return statement (which anyway inevitably leads to such statement(s)) by traversing the respective section of the CFG in a depth-first manner. A complete solution still seems elusive. rdar://problem/28157554 Differential Revision: https://reviews.llvm.org/D35673 llvm-svn: 308957
* Remove Bitrig: Clang ChangesErich Keane2017-07-211-1/+0
| | | | | | | | Bitrig code has been merged back to OpenBSD, thus the OS has been abandoned. Differential Revision: https://reviews.llvm.org/D35708 llvm-svn: 308797
* Revert "[StaticAnalyzer] Completely unrolling specific loops with known ↵Peter Szecsi2017-07-205-235/+1
| | | | | | | | | | bound option" Revert r308561 and r308558. Clang-ppc64be-linux seems to crash while running the test cases. llvm-svn: 308592
* [StaticAnalyzer] Completely unrolling specific loops with known bound option Peter Szecsi2017-07-201-0/+203
| | | | | | Missing files added to rL308558. llvm-svn: 308561
* This feature allows the analyzer to consider loops to completely unroll. NewPeter Szecsi2017-07-194-1/+32
| | | | | | | | | | | | | | | | requirements/rules (for unrolling) can be added easily via ASTMatchers. The current implementation is hidden behind a flag. Right now the blocks which belong to an unrolled loop are marked by the LoopVisitor which adds them to the ProgramState. Then whenever we encounter a CFGBlock in the processCFGBlockEntrance which is marked then we skip its investigating. That means, it won't be considered to be visited more than the maximal bound for visiting since it won't be checked. Differential Revision: https://reviews.llvm.org/D34260 llvm-svn: 308558
* [analyzer] Add annotation attribute to trust retain count implementationDevin Coughlin2017-07-191-4/+31
| | | | | | | | | | | | | | | | | Add support to the retain-count checker for an annotation indicating that a function's implementation should be trusted by the retain count checker. Functions with these attributes will not be inlined and the arguments will be treating as escaping. Adding this annotation avoids spurious diagnostics when the implementation of a reference counting operation is visible but the analyzer can't reason precisely about the ref count. Patch by Malhar Thakkar! Differential Revision: https://reviews.llvm.org/D34937 llvm-svn: 308416
* [analyzer] Add annotation for functions taking user-facing stringsErik Verbruggen2017-07-141-10/+59
| | | | | | | | | | | | | | | | There was already a returns_localized_nsstring annotation to indicate that the return value could be passed to UIKit methods that would display them. However, those UIKit methods were hard-coded, and it was not possible to indicate that other classes/methods in a code-base would do the same. The takes_localized_nsstring annotation can be put on function parameters and selector parameters to indicate that those will also show the string to the user. Differential Revision: https://reviews.llvm.org/D35186 llvm-svn: 308012
* Revert "[analyzer] Support generating and reasoning over more symbolic ↵Dominic Chen2017-07-123-38/+22
| | | | | | | | | | constraint types" Assertion `Loc::isLocType(SSE->getLHS()->getType())' failed in Analysis/PR3991.m This reverts commit e469ff2759275e67f9072b3d67fac90f647c0fe6. llvm-svn: 307853
* [analyzer] Support generating and reasoning over more symbolic constraint typesDominic Chen2017-07-123-22/+38
| | | | | | | | | | | | Summary: Generate more IntSymExpr constraints, perform SVal simplification for IntSymExpr and SymbolCast constraints, and create fully symbolic SymExprs Reviewers: zaks.anna, dcoughlin, NoQ, xazax.hun Subscribers: mgorny, cfe-commits Differential Revision: https://reviews.llvm.org/D28953 llvm-svn: 307833
* CFG: Add CFGElement for automatic variables that leave the scopeMatthias Gehre2017-07-124-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This mimics the implementation for the implicit destructors. The generation of this scope leaving elements is hidden behind a flag to the CFGBuilder, thus it should not affect existing code. Currently, I'm missing a test (it's implicitly tested by the clang-tidy lifetime checker that I'm proposing). I though about a test using debug.DumpCFG, but then I would have to add an option to StaticAnalyzer/Core/AnalyzerOptions to enable the scope leaving CFGElement, which would only be useful to that particular test. Any other ideas how I could make a test for this feature? Reviewers: krememek, jordan_rose Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D15031 llvm-svn: 307759
* [analyzer] Start fixing modeling of bool based typesAlexander Shaposhnikov2017-07-111-5/+2
| | | | | | | | | | | | | | | | | | | This is a follow up for one of the previous diffs https://reviews.llvm.org/D32328. getTypeSize and with getIntWidth are not equivalent for bool (see https://clang.llvm.org/doxygen/ASTContext_8cpp_source.html#l08444), this causes a number of issues (for instance, if APint X representing a bool is created with the wrong bit width then X is not comparable against Min/Max (because of the different bit width), that results in crashes (triggered asserts) inside assume* methods), for examples see the newly added test cases. Test plan: make check-all Differential revision: https://reviews.llvm.org/D35041 llvm-svn: 307604
* [analyzer] Move zero-size allocation checks to optin.portability.Artem Dergachev2017-06-271-20/+35
| | | | | | | | | | | | | | This is a new checker package. It contains checkers that highlight well-documented implementation-defined behavior. Such checkers are only useful to developers that intend to write portable code. Code that is only compiled for a single platform should be allowed to rely on this platform's specific documented behavior. rdar://problem/30545046 Differential Revision: https://reviews.llvm.org/D34102 llvm-svn: 306396
* [analyzer] Do not continue to analyze a path if the constraints contradict ↵Gabor Horvath2017-06-221-1/+3
| | | | | | | | with builtin assume Differential Revision: https://reviews.llvm.org/D34502 llvm-svn: 305991
* [analyzer] Bump a few default performance thresholds.Artem Dergachev2017-06-211-2/+2
| | | | | | | | | | | | | | This makes the analyzer around 10% slower by default, allowing it to find deeper bugs. Default values for the following -analyzer-config change: max-nodes: 150000 -> 225000; max-inlinable-size: 50 -> 100. rdar://problem/32539666 Differential Revision: https://reviews.llvm.org/D34277 llvm-svn: 305900
* [analyzer] LocalizationChecker: Support new localizable APIs.Artem Dergachev2017-06-211-0/+43
| | | | | | | | | | | | Add support for new methods that were added in macOS High Sierra & iOS 11 and require a localized string. Patch by Kulpreet Chilana! rdar://problem/32795210 Differential Revision: https://reviews.llvm.org/D34266 llvm-svn: 305896
* [analyzer] Teach CloneDetection about Qt Meta-Object Compiler to filter auto ↵Leslie Zhai2017-06-201-1/+1
| | | | | | | | | | | | generated files Reviewers: v.g.vassilev, teemperor Reviewed By: teemperor Differential Revision: https://reviews.llvm.org/D34353 llvm-svn: 305774
* [analyzer] Check NULL pointer dereference issue for memset functionLeslie Zhai2017-06-201-0/+51
| | | | | | | | | | Reviewers: dcoughlin, zaks.anna, NoQ, danielmarjamaki Reviewed By: NoQ, danielmarjamaki Differential Revision: https://reviews.llvm.org/D31868 llvm-svn: 305773
* [analyzer] Fix logical not for pointers with different bit widthDaniel Marjamaki2017-06-191-3/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D31029 llvm-svn: 305669
* [analyzer] Teach CloneDetection about Qt Meta-Object CompilerLeslie Zhai2017-06-191-1/+6
| | | | | | | | | | Reviewers: v.g.vassilev, zaks.anna, NoQ, teemperor Reviewed By: v.g.vassilev, zaks.anna, NoQ, teemperor Differential Revision: https://reviews.llvm.org/D31320 llvm-svn: 305659
* [analyzer] Fix a crash when an ObjC object is constructed in AllocaRegion.Artem Dergachev2017-06-121-0/+6
| | | | | | | | | | | | Memory region allocated by alloca() carries no implicit type information. Don't crash when resolving the init message for an Objective-C object that is being constructed in such region. rdar://problem/32517077 Differential Revision: https://reviews.llvm.org/D33828 llvm-svn: 305211
* [analyzer] Don't add arrow to the inlined function's decl when it has no body.Artem Dergachev2017-06-051-3/+9
| | | | | | | | | | | | | In plist output mode with alternate path diagnostics, when entering a function, we draw an arrow from the caller to the beginning of the callee's declaration. Upon exiting, however, we draw the arrow from the last statement in the callee function. The former makes little sense when the declaration is not a definition, i.e. has no body, which may happen in case the body is coming from a body farm, eg. Objective-C autosynthesized property accessor. Differential Revision: https://reviews.llvm.org/D33671 llvm-svn: 304713
* [analyzer] Nullability: fix notes around synthesized ObjC property accessors.Artem Dergachev2017-06-052-3/+45
| | | | | | | | | | | | | Nullable-to-nonnull checks used to crash when the custom bug visitor was trying to add its notes to autosynthesized accessors of Objective-C properties. Now we avoid this, mostly automatically outside of checker control, by moving the diagnostic to the parent stack frame where the accessor has been called. Differential revision: https://reviews.llvm.org/D32437 llvm-svn: 304710
* Added LLVM_FALLTHROUGH to address warning: this statement may fall through. NFC.Galina Kistanova2017-06-034-0/+4
| | | | llvm-svn: 304644
* [analyzer] Fix immutable map factory lifetime for partial taint.Artem Dergachev2017-05-291-13/+10
| | | | | | | | | This should fix the leaks found by asan buildbot in r304162. Also don't store a reference to the factory with every map value, which is the only difference between ImmutableMap and ImmutableMapRef. llvm-svn: 304170
* [analyzer] Support partially tainted records.Artem Dergachev2017-05-293-80/+111
| | | | | | | | | | | | | | | | The analyzer's taint analysis can now reason about structures or arrays originating from taint sources in which only certain sections are tainted. In particular, it also benefits modeling functions like read(), which may read tainted data into a section of a structure, but RegionStore is incapable of expressing the fact that the rest of the structure remains intact, even if we try to model read() directly. Patch by Vlad Tsyrklevich! Differential revision: https://reviews.llvm.org/D28445 llvm-svn: 304162
* [analyzer] Initial commit for the upcoming refactoring of the IteratorChecker.Artem Dergachev2017-05-293-841/+834
| | | | | | | | | | | | | | | The new checker currently contains the very core infrastructure for tracking the state of iterator-type objects in the analyzer: relating iterators to their containers, tracking symbolic begin and end iterator values for containers, and solving simple equality-type constraints over iterators. A single specific check over this infrastructure is capable of finding usage of out-of-range iterators in some simple cases. Patch by Ádám Balogh! Differential revision: https://reviews.llvm.org/D32592 llvm-svn: 304160
* [analyzer] PthreadLockChecker: model failed pthread_mutex_destroy() calls.Artem Dergachev2017-05-291-13/+133
| | | | | | | | | | | | | pthread_mutex_destroy() may fail, returning a non-zero error number, and keeping the mutex untouched. The mutex can be used on the execution branch that follows such failure, so the analyzer shouldn't warn on using a mutex that was previously destroyed, when in fact the destroy call has failed. Patch by Malhar Thakkar! Differential revision: https://reviews.llvm.org/D32449 llvm-svn: 304159
* [Statistics] Use the new Statistic::updateMax to atomically calculate a ↵Craig Topper2017-05-182-8/+4
| | | | | | maximum value statistic. llvm-svn: 303320
* [StaticAnalyzer] Move inline counter increaser to inlineCall functionPeter Szecsi2017-05-161-2/+1
| | | | | | | | | | | Even though the shouldInlineCall function returns true, it can happen that the function is not going to be inlined (as it can be seen at line 913 and below). Moved the bumpNumTimesInlined(D) (the counter increaser) call to the inlineCall function where it logically belongs. Differential Revision: https://reviews.llvm.org/D32179 llvm-svn: 303158
* [analyzer] Add modelling of __builtin_assumeGabor Horvath2017-05-121-0/+16
| | | | | | Differential Revision: https://reviews.llvm.org/D33092 llvm-svn: 302880
* [analyzer] Avoid an allocation in Std C function modellingGabor Horvath2017-05-121-1/+4
| | | | | | Differential Revision: https://reviews.llvm.org/D33095 llvm-svn: 302879
OpenPOWER on IntegriCloud