summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [NFC] Header cleanupMehdi Amini2016-07-1817-29/+4
| | | | | | | | | | Summary: Removed unused headers, replaced some headers with forward class declarations Patch by: Eugene <claprix@yandex.ru> Differential Revision: https://reviews.llvm.org/D20100 llvm-svn: 275882
* Revert "[analyzer] Add checker modeling potential C++ self-assignment"Devin Coughlin2016-07-185-122/+3
| | | | | | This reverts commit r275820. It is failing on the bots. llvm-svn: 275880
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-185-3/+122
| | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 275820
* [ObjC] Implement @available in the Parser and ASTErik Pilkington2016-07-161-0/+1
| | | | | | | | | | | | | | | | This patch adds a new AST node: ObjCAvailabilityCheckExpr, and teaches the Parser and Sema to generate it. This node represents an availability check of the form: @available(macos 10.10, *); Which will eventually compile to a runtime check of the host's OS version. This is the first patch of the feature I proposed here: http://lists.llvm.org/pipermail/cfe-dev/2016-July/049851.html Differential Revision: https://reviews.llvm.org/D22171 llvm-svn: 275654
* [OpenMP] Sema and parsing for 'target parallel for simd' pragmaKelvin Li2016-07-141-0/+1
| | | | | | | | This patch is to implement sema and parsing for 'target parallel for simd' pragma. Differential Revision: http://reviews.llvm.org/D22096 llvm-svn: 275365
* [analyzer] Implement a methond to discover origin region of a symbol.Artem Dergachev2016-07-132-18/+2
| | | | | | | | | | | | | This encourages checkers to make logical decisions depending on value of which region was the symbol under consideration introduced to denote. A similar technique is already used in a couple of checkers; they were modified to call the new method. Differential Revision: http://reviews.llvm.org/D22242 llvm-svn: 275290
* [analyzer] Older version of GCC 4.7 crash on lambdas in default arguments.Benjamin Kramer2016-07-091-8/+9
| | | | llvm-svn: 274975
* [analyzer] Rewrite manual erase loop using remove_if.Benjamin Kramer2016-07-091-15/+14
| | | | | | No functionality change intended. llvm-svn: 274974
* [analyzer] Add rudimentary handling of AtomicExpr.Devin Coughlin2016-07-081-1/+44
| | | | | | | | | | | | | | This proposed patch adds crude handling of atomics to the static analyzer. Rather than ignore AtomicExprs, as we now do, this patch causes the analyzer to escape the arguments. This is imprecise -- and we should model the expressions fully in the future -- but it is less wrong than ignoring their effects altogether. This is rdar://problem/25353187 Differential Revision: http://reviews.llvm.org/D21667 llvm-svn: 274816
* [analyzer] Suppress false positives in std::shared_ptrDevin Coughlin2016-07-061-6/+14
| | | | | | | | | | | | | | | | | | | | | The analyzer does not model C++ temporary destructors completely and so reports false alarms about leaks of memory allocated by the internals of shared_ptr: std::shared_ptr<int> p(new int(1)); p = nullptr; // 'Potential leak of memory pointed to by field __cntrl_' This patch suppresses all diagnostics where the end of the path is inside a method in std::shared_ptr. It also reorganizes the tests for suppressions in the C++ standard library to use a separate simulated header for library functions with bugs that were deliberately inserted to test suppression. This will prevent other tests from using these as models. rdar://problem/23652766 llvm-svn: 274691
* [OpenMP] Sema and parsing for 'distribute simd' pragmaKelvin Li2016-07-061-0/+1
| | | | | | | | Summary: This patch is an implementation of sema and parsing for the OpenMP composite pragma 'distribute simd'. Differential Revision: http://reviews.llvm.org/D22007 llvm-svn: 274604
* [OpenMP] Sema and parse for 'distribute parallel for simd'Kelvin Li2016-07-051-0/+1
| | | | | | | | Summary: This patch is an implementation of sema and parsing for the OpenMP composite pragma 'distribute parallel for simd'. Differential Revision: http://reviews.llvm.org/D21977 llvm-svn: 274530
* Use arrays or initializer lists to feed ArrayRefs instead of SmallVector ↵Benjamin Kramer2016-07-021-4/+1
| | | | | | | | where possible. No functionality change intended llvm-svn: 274432
* P0136R1, DR1573, DR1645, DR1715, DR1736, DR1903, DR1941, DR1959, DR1991:Richard Smith2016-06-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace inheriting constructors implementation with new approach, voted into C++ last year as a DR against C++11. Instead of synthesizing a set of derived class constructors for each inherited base class constructor, we make the constructors of the base class visible to constructor lookup in the derived class, using the normal rules for using-declarations. For constructors, UsingShadowDecl now has a ConstructorUsingShadowDecl derived class that tracks the requisite additional information. We create shadow constructors (not found by name lookup) in the derived class to model the actual initialization, and have a new expression node, CXXInheritedCtorInitExpr, to model the initialization of a base class from such a constructor. (This initialization is special because it performs real perfect forwarding of arguments.) In cases where argument forwarding is not possible (for inalloca calls, variadic calls, and calls with callee parameter cleanup), the shadow inheriting constructor is not emitted and instead we directly emit the initialization code into the caller of the inherited constructor. Note that this new model is not perfectly compatible with the old model in some corner cases. In particular: * if B inherits a private constructor from A, and C uses that constructor to construct a B, then we previously required that A befriends B and B befriends C, but the new rules require A to befriend C directly, and * if a derived class has its own constructors (and so its implicit default constructor is suppressed), it may still inherit a default constructor from a base class llvm-svn: 274049
* Resubmission of http://reviews.llvm.org/D21564 after fixes.Carlo Bertolli2016-06-271-0/+1
| | | | | | | | | | | | | [OpenMP] Initial implementation of parse and sema for composite pragma 'distribute parallel for' This patch is an initial implementation for #distribute parallel for. The main differences that affect other pragmas are: The implementation of 'distribute parallel for' requires blocking of the associated loop, where blocks are "distributed" to different teams and iterations within each block are scheduled to parallel threads within each team. To implement blocking, sema creates two additional worksharing directive fields that are used to pass the team assigned block lower and upper bounds through the outlined function resulting from 'parallel'. In this way, scheduling for 'for' to threads can use those bounds. As a consequence of blocking, the stride of 'distribute' is not 1 but it is equal to the blocking size. This is returned by the runtime and sema prepares a DistIncrExpr variable to hold that value. As a consequence of blocking, the global upper bound (EnsureUpperBound) expression of the 'for' is not the original loop upper bound (e.g. in for(i = 0 ; i < N; i++) this is 'N') but it is the team-assigned block upper bound. Sema creates a new expression holding the calculation of the actual upper bound for 'for' as UB = min(UB, PrevUB), where UB is the loop upper bound, and PrevUB is the team-assigned block upper bound. llvm-svn: 273884
* Revert r273705Carlo Bertolli2016-06-241-1/+0
| | | | | | [OpenMP] Initial implementation of parse and sema for composite pragma 'distribute parallel for' llvm-svn: 273709
* [OpenMP] Initial implementation of parse and sema for composite pragma ↵Carlo Bertolli2016-06-241-0/+1
| | | | | | | | | | | | | | | 'distribute parallel for' http://reviews.llvm.org/D21564 This patch is an initial implementation for #distribute parallel for. The main differences that affect other pragmas are: The implementation of 'distribute parallel for' requires blocking of the associated loop, where blocks are "distributed" to different teams and iterations within each block are scheduled to parallel threads within each team. To implement blocking, sema creates two additional worksharing directive fields that are used to pass the team assigned block lower and upper bounds through the outlined function resulting from 'parallel'. In this way, scheduling for 'for' to threads can use those bounds. As a consequence of blocking, the stride of 'distribute' is not 1 but it is equal to the blocking size. This is returned by the runtime and sema prepares a DistIncrExpr variable to hold that value. As a consequence of blocking, the global upper bound (EnsureUpperBound) expression of the 'for' is not the original loop upper bound (e.g. in for(i = 0 ; i < N; i++) this is 'N') but it is the team-assigned block upper bound. Sema creates a new expression holding the calculation of the actual upper bound for 'for' as UB = min(UB, PrevUB), where UB is the loop upper bound, and PrevUB is the team-assigned block upper bound. llvm-svn: 273705
* DeadStoresChecker: Don't warn about dead stores into volatile variablesStephan Bergmann2016-06-241-0/+2
| | | | llvm-svn: 273689
* Use more ArrayRefsDavid Majnemer2016-06-242-3/+3
| | | | | | No functional change is intended, just a small refactoring. llvm-svn: 273647
* [Analyzer] Don't cache report generation ExplodedNodesBen Craig2016-06-232-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | During the core analysis, ExplodedNodes are added to the ExplodedGraph, and those nodes are cached for deduplication purposes. After core analysis, reports are generated. Here, trimmed copies of the ExplodedGraph are made. Since the ExplodedGraph has already been deduplicated, there is no need to deduplicate again. This change makes it possible to add ExplodedNodes to an ExplodedGraph without the overhead of deduplication. "Uncached" nodes also cannot be iterated over, but none of the report generation code attempts to iterate over all nodes. This change reduces the analysis time of a large .C file from 3m43.941s to 3m40.256s (~1.6% speedup). It should slightly reduce memory consumption. Gains should be roughly proportional to the number (and path length) of static analysis warnings. This patch enables future work that should remove the need for an InterExplodedGraphMap inverse map. I plan on using the (now unused) ExplodedNode link to connect new nodes to the original nodes. http://reviews.llvm.org/D21229 llvm-svn: 273572
* [analyzer] Teach ObjCDeallocChecker about XCTestCaseDevin Coughlin2016-06-221-9/+11
| | | | | | | | | | | Like with SenTestCase, subclasses of XCTestCase follow a "tear down" idiom to release instance variables and so typically do not release ivars in -dealloc. This commit applies the existing special casing for SenTestCase to XCTestCase as well. rdar://problem/25884696 llvm-svn: 273441
* [analyzer] Teach trackNullOrUndefValue() about class property accessors.Devin Coughlin2016-06-221-1/+4
| | | | | | | | | | Teach trackNullOrUndefValue() how to properly look through PseudoObjectExprs to find the underlying semantic method call for property getters. This fixes a crash when looking through class property getters that I introduced in r265839. rdar://problem/26796666 llvm-svn: 273340
* Revert accidential "[MSVC] Late parsing of in-class defined member functions ↵Alexey Bataev2016-06-151-1/+0
| | | | | | | | in template" This reverts commit 0253605771b8bd9d414aba74fe2742c730d6fd1a. llvm-svn: 272776
* [MSVC] Late parsing of in-class defined member functions in templateAlexey Bataev2016-06-151-0/+1
| | | | | | | | | | | | | | | | | | | classes. MSVC actively uses unqualified lookup in dependent bases, lookup at the instantiation point (non-dependent names may be resolved on things declared later) etc. and all this stuff is the main cause of incompatibility between clang and MSVC. Clang tries to emulate MSVC behavior but it may fail in many cases. clang could store lexed tokens for member functions definitions within ClassTemplateDecl for later parsing during template instantiation. It will allow resolving many possible issues with lookup in dependent base classes and removing many already existing MSVC-specific hacks/workarounds from the clang code. llvm-svn: 272774
* MPIBugReporter.h: Fix a warning. [-Wdocumentation]NAKAMURA Takumi2016-06-131-1/+1
| | | | llvm-svn: 272534
* [analyzer] Remove some list initialization from MPI Checker to make MSVC ↵Devin Coughlin2016-06-132-19/+19
| | | | | | | | | | bots happy. This is a speculative attempt to fix the compiler error: "list initialization inside member initializer list or non-static data member initializer is not implemented" with r272529. llvm-svn: 272530
* [analyzer] Add checker to verify the correct usage of the MPI APIDevin Coughlin2016-06-139-0/+1034
| | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to verify the correct usage of the MPI API in C and C++. This version updates the reverted r271981 to fix a memory corruption found by the ASan bots. Three path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker A patch by Alexander Droste! Reviewers: zaks.anna, dcoughlin Differential Revision: http://reviews.llvm.org/D21081 llvm-svn: 272529
* Preallocate ExplodedNode hash tableBen Craig2016-06-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | Rehashing the ExplodedNode table is very expensive. The hashing itself is expensive, and the general activity of iterating over the hash table is highly cache unfriendly. Instead, we guess at the eventual size by using the maximum number of steps allowed. This generally avoids a rehash. It is possible that we still need to rehash if the backlog of work that is added to the worklist significantly exceeds the number of work items that we process. Even if we do need to rehash in that scenario, this change is still a win, as we still have fewer rehashes that we would have prior to this change. For small work loads, this will increase the memory used. For large work loads, it will somewhat reduce the memory used. Speed is significantly increased. A large .C file took 3m53.812s to analyze prior to this change. Now it takes 3m38.976s, for a ~6% improvement. http://reviews.llvm.org/D20933 llvm-svn: 272394
* Prune away some unused using decls. NFC.Benjamin Kramer2016-06-082-2/+0
| | | | | | Found by clang's misc-unused-using-decls. llvm-svn: 272156
* Revert "[analyzer] Reapply r271907 (2nd try)."Devin Coughlin2016-06-079-1040/+0
| | | | | | | | Even with the fix in r271981, ASan is finding a stack use after return. This reverts commits r271977 and r271981. llvm-svn: 271984
* [analyzer] Speculative fix for r271907.Devin Coughlin2016-06-071-1/+1
| | | | | | | | Fix a compilation error on the bots involving brace initialization. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271981
* [analyzer] Reapply r271907 (2nd try).Devin Coughlin2016-06-079-0/+1040
| | | | | | | | | | | | | | Second try at reapplying "[analyzer] Add checker for correct usage of MPI API in C and C++." Special thanks to Dan Liew for helping test the fix for the template specialization compiler error with gcc. The original patch is by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271977
* Revert "Reapply "[analyzer] Add checker for correct usage of MPI API in C ↵Devin Coughlin2016-06-069-1040/+0
| | | | | | | | and C++."" This reverts commit r271914. It is still breaking bots. llvm-svn: 271920
* Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-069-0/+1040
| | | | | | | | | Reapply r271907 with a fix for the compiler error with gcc about specializing clang::ento::ProgramStateTrait in a different namespace. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271914
* Revert "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-069-1038/+0
| | | | | | | This reverts commit r271907. It broke a bunch of bots with compile errors about specializations in different namespaces. llvm-svn: 271909
* [analyzer] Add checker for correct usage of MPI API in C and C++.Devin Coughlin2016-06-069-0/+1038
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to check for the correct usage of the MPI API in C and C++. 3 path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait. - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call. Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker Reviewers: zaks.anna A patch by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271907
* Apply clang-tidy's misc-move-constructor-init throughout Clang.Benjamin Kramer2016-05-277-17/+23
| | | | | | No functionality change intended, maybe a tiny performance improvement. llvm-svn: 270996
* [OpenMP] Parsing and sema support for target update directiveSamuel Antao2016-05-261-0/+1
| | | | | | | | | | | | | | | Summary: This patch is to add parsing and sema support for `target update` directive. Support for the `to` and `from` clauses will be added by a different patch. This patch also adds support for other clauses that are already implemented upstream and apply to `target update`, e.g. `device` and `if`. This patch is based on the original post by Kelvin Li. Reviewers: hfinkel, carlo.bertolli, kkwli0, arpith-jacob, ABataev Subscribers: caomhin, cfe-commits Differential Revision: http://reviews.llvm.org/D15944 llvm-svn: 270878
* [Analyzer] Correct stack address escape diagnosticSean Eveson2016-05-261-1/+6
| | | | | | | | | | | | | | | | | | Summary: Leaking a stack address via a static variable refers to it in the diagnostic as a 'global'. This patch corrects the diagnostic for static variables. Patch by Phil Camp, SN Systems Reviewers: dcoughlin, zaks.anna Subscribers: xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D19866 Patch by Phil Camp llvm-svn: 270849
* [analyzer] Fix for PR23790 : constrain return value of strcmp() rather than ↵Anton Yartsev2016-05-191-17/+20
| | | | | | | | | | returning a concrete value. The function strcmp() can return any value, not just {-1,0,1} : "The strcmp(const char *s1, const char *s2) function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by s1 is greater than, equal to, or less than the string pointed to by s2." [C11 7.24.4.2p3] https://llvm.org/bugs/show_bug.cgi?id=23790 http://reviews.llvm.org/D16317 llvm-svn: 270154
* [analyzer] Fix crash in ObjCGenericsCheckerDevin Coughlin2016-05-111-0/+25
| | | | | | | | | | | | | | | Fix a crash in the generics checker where DynamicTypePropagation tries to get the superclass of a root class. This is a spot-fix for a deeper issue where the checker makes assumptions that may not hold about subtyping between the symbolically-tracked type of a value and the compile-time types of a cast on that value. I've added a TODO to address the underlying issue. rdar://problem/26086914 llvm-svn: 269227
* [analyzer] Add path note for localizability checker.Devin Coughlin2016-04-281-0/+64
| | | | | | | | | Add a path note indicating the location of the non-localized string literal in NonLocalizedStringChecker. rdar://problem/25981525 llvm-svn: 267924
* [analyzer] Move Checkers.inc to clang/include/...Chih-Hung Hsieh2016-04-284-658/+2
| | | | | | | | Simplify sharing of Checkers.inc with other files like ClangTidy.cpp. Differential Revision: http://reviews.llvm.org/19393 llvm-svn: 267832
* [analyzer] Let TK_PreserveContents span across the whole base region.Artem Dergachev2016-04-252-2/+2
| | | | | | | | | | | | If an address of a field is passed through a const pointer, the whole structure's base region should receive the TK_PreserveContents trait and avoid invalidation. Additionally, include a few FIXME tests shown up during testing. Differential Revision: http://reviews.llvm.org/D19057 llvm-svn: 267413
* [analyzer] Nullability: Suppress diagnostic on bind with cast.Devin Coughlin2016-04-131-6/+28
| | | | | | | | | | | | | | Update the nullability checker to allow an explicit cast to nonnull to suppress a warning on an assignment of nil to a nonnull: id _Nonnull x = (id _Nonnull)nil; // no-warning This suppression as already possible for diagnostics on returns and function/method arguments. rdar://problem/25381178 llvm-svn: 266219
* [analyzer] Nullability: Treat nil _Nonnull ivar as invariant violation.Devin Coughlin2016-04-131-14/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Treat a _Nonnull ivar that is nil as an invariant violation in a similar fashion to how a nil _Nonnull parameter is treated as a precondition violation. This avoids warning on defensive returns of nil on defensive internal checks, such as the following common idiom: @class InternalImplementation @interface PublicClass { InternalImplementation * _Nonnull _internal; } -(id _Nonnull)foo; @end @implementation PublicClass -(id _Nonnull)foo { if (!_internal) return nil; // no-warning return [_internal foo]; } @end rdar://problem/24485171 llvm-svn: 266157
* [analyzer] Nullability: Suppress return diagnostics in inlined functions.Devin Coughlin2016-04-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The nullability checker can sometimes miss detecting nullability precondition violations in inlined functions because the binding for the parameter that violated the precondition becomes dead before the return: int * _Nonnull callee(int * _Nonnull p2) { if (!p2) // p2 becomes dead here, so binding removed. return 0; // warning here because value stored in p2 is symbolic. else return p2; } int *caller(int * _Nonnull p1) { return callee(p1); } The fix, which is quite blunt, is to not warn about null returns in inlined methods/functions. This won’t lose much coverage for ObjC because the analyzer always analyzes each ObjC method at the top level in addition to inlined. It *will* lose coverage for C — but there aren’t that many codebases with C nullability annotations. rdar://problem/25615050 llvm-svn: 266109
* [analyzer] Fix assertion in ReturnVisitor for body-farm synthesized gettersDevin Coughlin2016-04-121-0/+3
| | | | | | | Don't emit a path note marking the return site if the return statement does not have a valid location. This fixes an assertion failure I introduced in r265839. llvm-svn: 266031
* Remove redundant conditions of the form (A || (!A && B)) -> (A || B)Benjamin Kramer2016-04-112-7/+5
| | | | | | Found by cppcheck! PR27286 PR27287 PR27288 PR27289 llvm-svn: 265918
* [analyzer] Teach trackNullOrUndefValue about calls to property accessors.Devin Coughlin2016-04-081-0/+6
| | | | | | | | | | | Teach trackNullOrUndefValue() how to look through PseudoObjectExprs to find the underlying method call for property getters. This makes over-suppression of 'return nil' in getters consistent with the similar over-suppression for method and function calls. rdar://problem/24437252 llvm-svn: 265839
OpenPOWER on IntegriCloud