summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "[analyzer] Add extra notes to ObjCDeallocChecker" as its depends on ↵Vitaly Buka2016-10-041-29/+3
| | | | | | | | reverted r283092 This reverts commit r283093. llvm-svn: 283181
* Revert "[analyzer] Extend bug reports with extra notes" to fix Windows bot.Vitaly Buka2016-10-046-157/+52
| | | | | | This reverts commit r283092. llvm-svn: 283180
* [analyzer] Improve CloneChecker diagnosticsArtem Dergachev2016-10-031-50/+56
| | | | | | | | | | | | | | | | | | Highlight code clones referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Change warning text to more clang-ish. Remove suggestions from the copy-paste error checker diagnostics, because currently our suggestions are strictly 50% wrong (we do not know which of the two code clones contains the error), and for that reason we should not sound as if we're actually suggesting this. Hopefully a better solution would bring them back. Make sure the suspicious clone pair structure always mentions the correct variable for the second clone. Differential Revision: https://reviews.llvm.org/D24916 llvm-svn: 283094
* [analyzer] Add extra notes to ObjCDeallocCheckerArtem Dergachev2016-10-031-3/+29
| | | | | | | | | | The report is now highlighting instance variables and properties referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Differential Revision: https://reviews.llvm.org/D24915 llvm-svn: 283093
* [analyzer] Extend bug reports with extra notesArtem Dergachev2016-10-036-52/+157
| | | | | | | | | | | | | | | | | | | | These diagnostics are separate from the path-sensitive engine's path notes, and can be added manually on top of path-sensitive or path-insensitive reports. The new note diagnostics would appear as note:-diagnostic on console and as blue bubbles in scan-build. In plist files they currently do not appear, because format needs to be discussed with plist file users. The analyzer option "-analyzer-config notes-as-events=true" would convert notes to normal path notes, and put them at the beginning of the path. This is a temporary hack to show the new notes in plist files. A few checkers would be updated in subsequent commits, including tests for this new feature. Differential Revision: https://reviews.llvm.org/D24278 llvm-svn: 283092
* [StaticAnalyzer] Fix false positives for vardecls that are technically ↵Daniel Marjamaki2016-09-281-2/+4
| | | | | | | | | | | | | | | unreachable but they are needed. Example: switch (x) { int a; // <- This is unreachable but needed case 1: a = ... Differential Revision: https://reviews.llvm.org/D24905 llvm-svn: 282574
* Adapt to LLVM EnableStatistics() change.Matthias Braun2016-09-271-1/+1
| | | | llvm-svn: 282533
* CC1: Add -save-stats optionMatthias Braun2016-09-261-1/+3
| | | | | | | | | This option behaves in a similar spirit as -save-temps and writes internal llvm statistics in json format to a file. Differential Revision: https://reviews.llvm.org/D24820 llvm-svn: 282426
* [analyzer] Improve CastToStruct checker so it can also detect widening casts ↵Daniel Marjamaki2016-09-261-22/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | of struct data Example: struct AB { int A; int B; }; struct ABC { int A; int B; int C; }; void f() { struct AB Data; struct ABC *P = (struct ABC *)&Data; } Differential Revision: https://reviews.llvm.org/D23508 llvm-svn: 282411
* [analyzer] Fix crash in RetainCountChecker::checkEndFunctionAlexander Shaposhnikov2016-09-232-3/+7
| | | | | | | | | | | | | | | | | The class BodyFarm creates bodies for OSAtomicCompareAndSwap*, objc_atomicCompareAndSwap*, dispatch_sync*, dispatch_once* and for them the flag isBodyAutosynthesized is set to true. This diff 1. makes AnalysisConsumer::HandleCode skip the autosynthesized code 2. replaces assert(LCtx->getParent()) in RetainCountChecker::checkEndFunction by assert(!LCtx->inTopFrame()) (minor cleanup) Test plan: make -j8 check-clang-analysis Differential revision: https://reviews.llvm.org/D24792 llvm-svn: 282293
* [analyzer] Add a checker that detects blocks in critical sectionsAnna Zaks2016-09-202-0/+110
| | | | | | | | | | | | | | | | | | | | | | | | | This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock. Example: mutex_t m; void f() { sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked] // do some work } void foobar() { lock(m); f(); unlock(m); } A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D21506 llvm-svn: 282011
* [analyzer] Calculate extent size for memory regions allocated by new expression.Gabor Horvath2016-09-192-12/+57
| | | | | | | | | | | ArrayBoundChecker did not detect out of bounds memory access errors in case an array was allocated by the new expression. This patch resolves this issue. Patch by Daniel Krupp! Differential Revision: https://reviews.llvm.org/D24307 llvm-svn: 281934
* [analyzer] Fix ExprEngine::VisitMemberExprAlexander Shaposhnikov2016-09-131-1/+1
| | | | | | | | | | | AST may contain intermediate ParenExpr nodes between MemberExpr and ArrayToPointerDecay. This diff adjusts the check in ExprEngine::VisitMemberExpr accordingly. Test plan: make -j8 check-clang-analysis Differential revision: https://reviews.llvm.org/D24484 llvm-svn: 281373
* ObjectiveC Generics: Start using ObjCTypeParamType.Manman Ren2016-09-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | For ObjC type parameter, we used to have TypedefType that is canonicalized to id or the bound type. We can't represent "T <protocol>" and thus will lose the type information in the following example: @interface MyMutableDictionary<KeyType, ObjectType> : NSObject - (void)setObject:(ObjectType)obj forKeyedSubscript:(KeyType <NSCopying>)key; @end MyMutableDictionary<NSString *, NSString *> *stringsByString; NSNumber *n1, *n2; stringsByString[n1] = n2; --> no warning on type mismatch of the key. To fix the problem, we introduce a new type ObjCTypeParamType that supports a list of protocol qualifiers. We create ObjCTypeParamType for ObjCTypeParamDecl when we create ObjCTypeParamDecl. We also substitute ObjCTypeParamType instead of TypedefType on an ObjCTypeParamDecl. rdar://24619481 rdar://25060179 Differential Revision: http://reviews.llvm.org/D23080 llvm-svn: 281358
* [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>Aleksei Sidorin2016-09-013-9/+58
| | | | | | | | | This patch also introduces AnalysisOrderChecker which is intended for testing of callback call correctness. Differential Revision: https://reviews.llvm.org/D23804 llvm-svn: 280367
* [analyzer] Add more FileIDs to PlistDiagnostic map to avoid assertionAleksei Sidorin2016-09-011-25/+27
| | | | | | | | | | | | | Some FileIDs that may be used by PlistDiagnostics were not added while building a list of pieces. This caused assertion violation in GetFID() function. This patch adds some missing FileIDs to avoid the assertion. It also contains small refactoring of PlistDiagnostics::FlushDiagnosticsImpl(). Patch by Aleksei Sidorin, Ilya Palachev. Differential Revision: https://reviews.llvm.org/D22090 llvm-svn: 280360
* [analyzer][test commit] ExprEngine.cpp: Remove training whitespace; NFCAleksei Sidorin2016-09-011-2/+2
| | | | llvm-svn: 280352
* [analyzer] Use lazily created buffer in EmptyLocalizationContextCheckerDevin Coughlin2016-08-301-1/+8
| | | | | | | | | | | Fix a crash when relexing the underlying memory buffer to find incorrect arguments to NSLocalizedString(). With precompiled headers, the raw buffer may be NULL. Instead, use the source manager to get the buffer, which will lazily create the buffer for precompiled headers. rdar://problem/27429091 llvm-svn: 280174
* Reapply "[analyzer] Added valist related checkers."Gabor Horvath2016-08-222-0/+374
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279427
* [analyzer] Correctly add assumptions based on array bounds.Gabor Horvath2016-08-221-12/+67
| | | | | | | | Also simplify the constraints generated by the checker. Differential Revision: https://reviews.llvm.org/D23112 llvm-svn: 279425
* [analyzer] Use faster hashing (MD5) in CloneDetector.Artem Dergachev2016-08-201-9/+0
| | | | | | | | | | | | | | | This replaces the old approach of fingerprinting every AST node into a string, which avoided collisions and was simple to implement, but turned out to be extremely ineffective with respect to both performance and memory. The collisions are now dealt with in a separate pass, which no longer causes performance problems because collisions are rare. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22515 llvm-svn: 279378
* [analyzer] Weaken assertion in trackNullOrUndefValue()Devin Coughlin2016-08-191-1/+1
| | | | | | | | | | | | | | | | | We should ignore paren casts when making sure that the semantic expression in a PseudoObjectExpr for an ObjC getter is a message send. This has no other intended functionality change. Adding a test for this exposed an interesting issue in another test case that only manifests under ARC. trackNullOrUndefValue() is not properly suppressing for nil values that are the result of nil propagation from a nil receiver when the nil is returned from a function. I've added a FIXME for that missing suppression. rdar://problem/27290568 llvm-svn: 279181
* [analyzer] Teach CloneDetector to find clones that look like copy-paste errors.Artem Dergachev2016-08-181-2/+70
| | | | | | | | | | | | | | | | | | | The original clone checker tries to find copy-pasted code that is exactly identical to the original code, up to minor details. As an example, if the copy-pasted code has all references to variable 'a' replaced with references to variable 'b', it is still considered to be an exact clone. The new check finds copy-pasted code in which exactly one variable seems out of place compared to the original code, which likely indicates a copy-paste error (a variable was forgotten to be renamed in one place). Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23314 llvm-svn: 279056
* Revert "[OpenMP] Sema and parsing for 'teams distribute simd’ pragma"Diana Picus2016-08-181-1/+0
| | | | | | | | | | | | | | | | | This reverts commit r279003 as it breaks some of our buildbots (e.g. clang-cmake-aarch64-quick, clang-x86_64-linux-selfhost-modules). The error is in OpenMP/teams_distribute_simd_ast_print.cpp: clang: /home/buildslave/buildslave/clang-cmake-aarch64-quick/llvm/include/llvm/ADT/DenseMap.h:527: bool llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::LookupBucketFor(const LookupKeyT&, const BucketT*&) const [with LookupKeyT = clang::Stmt*; DerivedT = llvm::DenseMap<clang::Stmt*, long unsigned int>; KeyT = clang::Stmt*; ValueT = long unsigned int; KeyInfoT = llvm::DenseMapInfo<clang::Stmt*>; BucketT = llvm::detail::DenseMapPair<clang::Stmt*, long unsigned int>]: Assertion `!KeyInfoT::isEqual(Val, EmptyKey) && !KeyInfoT::isEqual(Val, TombstoneKey) && "Empty/Tombstone value shouldn't be inserted into map!"' failed. llvm-svn: 279045
* revert [analyzer] Added valist related checkers.Gabor Horvath2016-08-182-374/+0
| | | | llvm-svn: 279043
* [analyzer] Added valist related checkers.Gabor Horvath2016-08-182-0/+374
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279041
* [analyzer] Small cleanups when checkers retrieving statements from explodedGabor Horvath2016-08-186-50/+9
| | | | | | | | nodes. Differential Revision: https://reviews.llvm.org/D23550 llvm-svn: 279037
* [OpenMP] Sema and parsing for 'teams distribute simd’ pragmaKelvin Li2016-08-171-0/+1
| | | | | | | | | | This patch is to implement sema and parsing for 'teams distribute simd’ pragma. This patch is originated by Carlo Bertolli. Differential Revision: https://reviews.llvm.org/D23528 llvm-svn: 279003
* [analyzer] Add a checker for loss of sign or precision in integral casts.Artem Dergachev2016-08-172-0/+193
| | | | | | | | | | | | | | | This new checker tries to find execution paths on which implicit integral casts cause definite loss of information: a certainly-negative integer is converted to an unsigned integer, or an integer is definitely truncated to fit into a smaller type. Being implicit, such casts are likely to produce unexpected results. Patch by Daniel Marjamäki! Differential Revision: https://reviews.llvm.org/D13126 llvm-svn: 278941
* [analyzer] Add LocationContext information to SymbolMetadata.Artem Dergachev2016-08-173-4/+7
| | | | | | | | | | | | | | | | | | | | | Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 llvm-svn: 278937
* StaticAnalyzer: Report found fields order in PaddingCheckerSaleem Abdulrasool2016-08-151-22/+36
| | | | | | | | Report the found fields order in PaddingChecker. Patch by Alexander Shaposhnikov! llvm-svn: 278730
* Revert test commitAlexander Droste2016-08-121-1/+0
| | | | llvm-svn: 278534
* Test commit - first LLVM repo commitAlexander Droste2016-08-121-0/+1
| | | | llvm-svn: 278533
* [analyzer] Teach RetainCountChecker about CVFooRetainDevin Coughlin2016-08-111-4/+6
| | | | | | | | | | | | Change the retain count checker to treat CoreFoundation-style "CV"-prefixed reference types from CoreVideo similarly to CoreGraphics types. With this change, we treat CVFooRetain() on a CVFooRef type as a retain. CVFooRelease() APIs are annotated as consuming their parameter, so this change prevents false positives about incorrect decrements of reference counts. <rdar://problem/27116090> llvm-svn: 278382
* [analyzer] Change -analyze-function to accept qualified names.Artem Dergachev2016-08-081-22/+60
| | | | | | | | | | | | | | | Both -analyze-function and -analyzer-display-progress now share the same convention for naming functions, which allows discriminating between methods with the same name in different classes, C++ overloads, and also presents Objective-C instance and class methods in the convenient notation. This also allows looking up the name for the particular function you're trying to restrict analysis to in the -analyzer-display-progress output, in case it was not instantly obvious. Differential Revision: https://reviews.llvm.org/D22856 llvm-svn: 278018
* [analyzer] Command line option to show enabled checker list.Gabor Horvath2016-08-082-5/+39
| | | | | | | | | | | | This patch adds a command line option to list the checkers that were enabled by analyzer-checker and not disabled by -analyzer-disable-checker. It can be very useful to debug long command lines when it is not immediately apparent which checkers are turned on and which checkers are turned off. Differential Revision: https://reviews.llvm.org/D23060 llvm-svn: 278006
* [analyzer] Model base to derived casts more precisely.Gabor Horvath2016-08-083-4/+25
| | | | | | | | | | | | | | Dynamic casts are handled relatively well by the static analyzer. BaseToDerived casts however are treated conservatively. This can cause some false positives with the NewDeleteLeaks checker. This patch alters the behavior of BaseToDerived casts. In case a dynamic cast would succeed use the same semantics. Otherwise fall back to the conservative approach. Differential Revision: https://reviews.llvm.org/D23014 llvm-svn: 277989
* [StaticAnalyzer] Remove dead code.Benjamin Kramer2016-08-061-42/+0
| | | | llvm-svn: 277917
* [OpenMP] Sema and parsing for 'teams distribute' pragmaKelvin Li2016-08-051-0/+1
| | | | | | | | This patch is to implement sema and parsing for 'teams distribute' pragma. Differential Revision: https://reviews.llvm.org/D23189 llvm-svn: 277818
* [analyzer] Update two comments in MPI-Checker. NFC.Devin Coughlin2016-08-022-7/+4
| | | | | | | | | | Correct two comments that do not match the current behavior of the checker. A patch by Alexander Droste! Differential Revision: https://reviews.llvm.org/D22670 llvm-svn: 277547
* [analyzer] Update APIs taking user-facing strings.Devin Coughlin2016-07-301-6/+22
| | | | | | | | | | | Add new APIs that require localized strings and remove two APIs that were incorrectly marked as requiring a user-facing string. A patch by Kulpreet Chilana! Differential Revision: https://reviews.llvm.org/D22926 llvm-svn: 277273
* [OpenCL] Generate opaque type for sampler_t and function call for the ↵Yaxun Liu2016-07-281-0/+1
| | | | | | | | | | | | | | | | initializer Currently Clang use int32 to represent sampler_t, which have been a source of issue for some backends, because in some backends sampler_t cannot be represented by int32. They have to depend on kernel argument metadata and use IPA to find the sampler arguments and global variables and transform them to target specific sampler type. This patch uses opaque pointer type opencl.sampler_t* for sampler_t. For each use of file-scope sampler variable, it generates a function call of __translate_sampler_initializer. For each initialization of function-scope sampler variable, it generates a function call of __translate_sampler_initializer. Each builtin library can implement its own __translate_sampler_initializer(). Since the real sampler type tends to be architecture dependent, allowing it to be initialized by a library function simplifies backend design. A typical implementation of __translate_sampler_initializer could be a table lookup of real sampler literal values. Since its argument is always a literal, the returned pointer is known at compile time and easily optimized to finally become some literal values directly put into image read instructions. This patch is partially based on Alexey Sotkin's work in Khronos Clang (https://github.com/KhronosGroup/SPIR/commit/3d4eec61623502fc306e8c67c9868be2b136e42b). Differential Revision: https://reviews.llvm.org/D21567 llvm-svn: 277024
* [analyzer] Fix misleading indentation in ObjCDeallocChecker. NFC.Devin Coughlin2016-07-281-1/+1
| | | | llvm-svn: 277009
* [analyzer] Add check::BeginFunction to CheckerDocumentation checks. NFC.Devin Coughlin2016-07-281-0/+1
| | | | | | This was an oversight from when I added BeginFunction support in r261293. llvm-svn: 276950
* [analyzer] Hotfix for build failure due to declaration shadowing in r276782.Artem Dergachev2016-07-261-3/+3
| | | | | | | CloneDetector member variable is shadowing the class with the same name, which causes build failures on some platforms. llvm-svn: 276791
* [analyzer] Add basic capabilities to detect source code clones.Artem Dergachev2016-07-262-0/+97
| | | | | | | | | | | | | | | | | | | | | This patch adds the CloneDetector class which allows searching source code for clones. For every statement or group of statements within a compound statement, CloneDetector computes a hash value, and finds clones by detecting identical hash values. This initial patch only provides a simple hashing mechanism that hashes the kind of each sub-statement. This patch also adds CloneChecker - a simple static analyzer checker that uses CloneDetector to report copy-pasted code. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D20795 llvm-svn: 276782
* MPI-Checker: move MPIFunctionClassifier.hAlexander Kornienko2016-07-255-106/+10
| | | | | | | | | | | | | | | | Summary: This patch moves the MPIFunctionClassifier header to `clang/include/clang/StaticAnalyzer/Checkers`, in order to make it accessible in other parts of the architecture. Reviewers: dcoughlin, zaks.anna Subscribers: alexfh, cfe-commits Patch by Alexander Droste! Differential Revision: https://reviews.llvm.org/D22671 llvm-svn: 276639
* [analyzer] Pring LocationContext in ExplodedGraph dumps.Artem Dergachev2016-07-241-51/+41
| | | | | | | | | | Remove some FIXMEs in the surrounding code, which have been addressed long time ago by introducing checker-specific tags. Differential Revision: https://reviews.llvm.org/D22622 llvm-svn: 276557
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-215-3/+125
| | | | | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). This reapplies r275820 after fixing a string-lifetime issue discovered by the bots. A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 276365
* [OpenMP] Sema and parsing for 'target simd' pragmaKelvin Li2016-07-201-0/+1
| | | | | | | | This patch is to implement sema and parsing for 'target simd' pragma. Differential Revision: https://reviews.llvm.org/D22479 llvm-svn: 276203
OpenPOWER on IntegriCloud