summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [MSVC] 'property' with an empty array in array subscript expression.Alexey Bataev2015-11-251-0/+1
| | | | | | | | | | | | MSVC supports 'property' attribute and allows to apply it to the declaration of an empty array in a class or structure definition. For example: ``` __declspec(property(get=GetX, put=PutX)) int x[]; ``` The above statement indicates that x[] can be used with one or more array indices. In this case, i=p->x[a][b] will be turned into i=p->GetX(a, b), and p->x[a][b] = i will be turned into p->PutX(a, b, i); Differential Revision: http://reviews.llvm.org/D13336 llvm-svn: 254067
* [analyzer] Pass value expression for inlined defensive checks when binding ↵Devin Coughlin2015-11-241-1/+30
| | | | | | | | | | | | | | | | null to nonnull. The nullability checker was not suppressing false positives resulting from inlined defensive checks when null was bound to a nonnull variable because it was passing the entire bind statement rather than the value expression to trackNullOrUndefValue(). This commit changes that checker to synactically match on the bind statement to extract the value expression so it can be passed to trackNullOrUndefValue(). rdar://problem/23575439 llvm-svn: 254007
* Remove DataRecursiveASTVisitor; it no longer serves any purpose, since it's ↵Richard Smith2015-11-241-2/+2
| | | | | | just an alias for RecursiveASTVisitor. llvm-svn: 253949
* [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ ↵Devin Coughlin2015-11-201-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | lambdas as escaped. The analyzer currently reports dead store false positives when a local variable is captured by reference in a C++ lambda. For example: int local = 0; auto lambda = [&local]() { local++; }; local = 7; // False Positive: Value stored to 'local' is never read lambda(); In this case, the assignment setting `local` to 7 is not a dead store because the called lambda will later read that assigned value. This commit silences this source of false positives by treating locals captured by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker deals with locals whose address is taken. rdar://problem/22165179 llvm-svn: 253630
* [analyzer] Improve modeling of static initializers.Anna Zaks2015-11-191-4/+10
| | | | | | | | | | | | Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem. The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov! Differential Revision: http://reviews.llvm.org/D14652 llvm-svn: 253532
* [analyzer] Skip checking blocks in dependent contexts.Devin Coughlin2015-11-181-1/+5
| | | | | | | | | | | Since we don't check functions in dependent contexts, we should skip blocks in those contexts as well. This avoids an assertion failure when the DeadStoresChecker attempts to evaluate an array subscript expression with a dependent name type. rdar://problem/23564220 llvm-svn: 253516
* [analyzer] Refer to capture field to determine if capture is reference.Devin Coughlin2015-11-151-5/+5
| | | | | | | | | | | | | The analyzer incorrectly treats captures as references if either the original captured variable is a reference or the variable is captured by reference. This causes the analyzer to crash when capturing a reference type by copy (PR24914). Fix this by refering solely to the capture field to determine when a DeclRefExpr for a lambda capture should be treated as a reference type. https://llvm.org/bugs/show_bug.cgi?id=24914 rdar://problem/23524412 llvm-svn: 253157
* [static analyzer] Don't flag nil storage into NSMutableDictionary.Anna Zaks2015-11-111-2/+1
| | | | | | This is now allowed and has the behavior of removing the mapping. llvm-svn: 252679
* [Analyzer] Fix comments and formatting. NFC.Sean Eveson2015-11-102-4/+4
| | | | llvm-svn: 252599
* [analyzer] Fix assertion failure invalidating on const member function calls ↵Devin Coughlin2015-11-091-1/+3
| | | | | | | | (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
* StaticAnalyzer: Remove implicit ilist iterator conversions, NFCDuncan P. N. Exon Smith2015-11-061-6/+6
| | | | | | Remove implicit ilist iterator conversions from clangStaticAnalyzer. llvm-svn: 252360
* [analyzer] Add VforkChecker to find unsafe code in vforked process.Yury Gribov2015-11-065-9/+253
| | | | | | | | | | | | This checker looks for unsafe constructs in vforked process: function calls (excluding whitelist), memory write and returns. This was originally motivated by a vfork-related bug in xtables package. Patch by Yury Gribov. Differential revision: http://reviews.llvm.org/D14014 llvm-svn: 252285
* [analyzer] Update RegionStoreManager::getBinding to handle BlockDataRegionsDevin Coughlin2015-11-051-0/+4
| | | | | | | | | | | | Update RegionStoreManager::getBinding() to return UnknownVal when trying to get the binding for a BlockDataRegion. Previously, getBinding() would try to cast the BlockDataRegion to a TypedValueRegion and crash. This happened when a block was passed as a parameter to an inlined function for which StackHintGeneratorForSymbol::getMessage() tried to generate a stack hint message. rdar://problem/21291971 llvm-svn: 252185
* Fix some Clang-tidy modernize warnings, other minor fixes.Eugene Zelenko2015-11-042-4/+4
| | | | | | Differential revision: http://reviews.llvm.org/D14311 llvm-svn: 252081
* [analyzer] Add 'optin' checker package and move localizability checkers into it.Devin Coughlin2015-11-042-13/+44
| | | | | | | | | | | | | | | | | | | | | | This commit creates a new 'optin' top-level checker package and moves several of the localizability checkers into it. This package is for checkers that are not alpha and that would normally be on by default but where the driver does not have enough information to determine when they are applicable. The localizability checkers fit this criterion because the driver cannot determine whether a project is localized or not -- this is best determined at the IDE or build-system level. This new package is *not* intended for checkers that are too noisy to be on by default. The hierarchy under 'optin' mirrors that in 'alpha': checkers under 'optin' should be organized in the hierarchy they would have had if they were truly top level (e.g., optin.osx.cocoa.MyOptInChecker). Differential Revision: http://reviews.llvm.org/D14303 llvm-svn: 252080
* [analyzer] Move the ObjCGenericsChecker out of the alpha package.Devin Coughlin2015-11-031-4/+4
| | | | | | | It is now in the osx.cocoa package and so will be on by default for Apple toolchains. llvm-svn: 251966
* Support watchOS and tvOS driver optionsTim Northover2015-10-301-1/+2
| | | | | | | | This patch should add support for almost all command-line options and driver tinkering necessary to produce a correct "clang -cc1" invocation for watchOS and tvOS. llvm-svn: 251706
* Reapply r251621 "[Analyzer] Widening loops which do not exit"Sean Eveson2015-10-304-1/+94
| | | | | | It was not the cause of the build bot failure. llvm-svn: 251702
* Revert r251621 "[Analyzer] Widening loops which do not exit" (bot failure)Sean Eveson2015-10-304-94/+1
| | | | | | | | Seems to be causing clang-cmake-mips build bot to fail (timeout) http://lab.llvm.org:8011/builders/clang-cmake-mips/builds/10299 llvm-svn: 251697
* [Analyzer] Widening loops which do not exitSean Eveson2015-10-294-1/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Dear All, We have been looking at the following problem, where any code after the constant bound loop is not analyzed because of the limit on how many times the same block is visited, as described in bugzillas #7638 and #23438. This problem is of interest to us because we have identified significant bugs that the checkers are not locating. We have been discussing a solution involving ranges as a longer term project, but I would like to propose a patch to improve the current implementation. Example issue: ``` for (int i = 0; i < 1000; ++i) {...something...} int *p = 0; *p = 0xDEADBEEF; ``` The proposal is to go through the first and last iterations of the loop. The patch creates an exploded node for the approximate last iteration of constant bound loops, before the max loop limit / block visit limit is reached. It does this by identifying the variable in the loop condition and finding the value which is “one away” from the loop being false. For example, if the condition is (x < 10), then an exploded node is created where the value of x is 9. Evaluating the loop body with x = 9 will then result in the analysis continuing after the loop, providing x is incremented. The patch passes all the tests, with some modifications to coverage.c, in order to make the ‘function_which_gives_up’ continue to give up, since the changes allowed the analysis to progress past the loop. This patch does introduce possible false positives, as a result of not knowing the state of variables which might be modified in the loop. I believe that, as a user, I would rather have false positives after loops than do no analysis at all. I understand this may not be the common opinion and am interested in hearing your views. There are also issues regarding break statements, which are not considered. A more advanced implementation of this approach might be able to consider other conditions in the loop, which would allow paths leading to breaks to be analyzed. Lastly, I have performed a study on large code bases and I think there is little benefit in having “max-loop” default to 4 with the patch. For variable bound loops this tends to result in duplicated analysis after the loop, and it makes little difference to any constant bound loop which will do more than a few iterations. It might be beneficial to lower the default to 2, especially for the shallow analysis setting. Please let me know your opinions on this approach to processing constant bound loops and the patch itself. Regards, Sean Eveson SN Systems - Sony Computer Entertainment Group Reviewers: jordan_rose, krememek, xazax.hun, zaks.anna, dcoughlin Subscribers: krememek, xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D12358 llvm-svn: 251621
* Put global classes into the appropriate namespace.Benjamin Kramer2015-10-281-0/+2
| | | | | | | Most of the cases belong into an anonymous namespace. No functionality change intended. llvm-svn: 251514
* [analyzer] Assume escape is possible through system functions taking void*Anna Zaks2015-10-272-13/+30
| | | | | | | | | | | | | | | | | | The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
* [analyzer] Fix lambdas that are capturing constants.Gabor Horvath2015-10-271-7/+14
| | | | llvm-svn: 251407
* [analyzer] Fix another crash when analyzing lambda functions.Gabor Horvath2015-10-271-1/+2
| | | | llvm-svn: 251404
* [coroutines] Creation of promise object, lookup of operator co_await, buildingRichard Smith2015-10-271-0/+4
| | | | | | of await_* calls, and AST representation for same. llvm-svn: 251387
* [analyzer] Fixed a rare crash when analyzing lambda functions.Gabor Horvath2015-10-261-1/+1
| | | | llvm-svn: 251289
* [StaticAnalyzer] Use llvm::utostr and not to_string.Davide Italiano2015-10-231-1/+2
| | | | | | | The latter seems unsupported (at least) on MinGW and FreeBSD (where I hit this failure). We can't have nice things. llvm-svn: 251115
* Attempt to fix build bot test failures.Gabor Horvath2015-10-221-1/+1
| | | | llvm-svn: 251014
* [analyzer] Bug identificationGabor Horvath2015-10-226-10/+262
| | | | | | | | | | | | | | | | This patch adds hashes to the plist and html output to be able to identfy bugs for suppressing false positives or diff results against a baseline. This hash aims to be resilient for code evolution and is usable to identify bugs in two different snapshots of the same software. One missing piece however is a permanent unique identifier of the checker that produces the warning. Once that issue is resolved, the hashes generated are going to change. Until that point this feature is marked experimental, but it is suitable for early adoption. Differential Revision: http://reviews.llvm.org/D10305 Original patch by: Bence Babati! llvm-svn: 251011
* Roll-back r250822.Angel Garcia Gomez2015-10-2012-26/+27
| | | | | | | | | | Summary: It breaks the build for the ASTMatchers Subscribers: klimek, cfe-commits Differential Revision: http://reviews.llvm.org/D13893 llvm-svn: 250827
* Apply modernize-use-default to clang.Angel Garcia Gomez2015-10-2012-27/+26
| | | | | | | | | | | | Summary: Replace empty bodies of default constructors and destructors with '= default'. Reviewers: bkramer, klimek Subscribers: klimek, alexfh, cfe-commits Differential Revision: http://reviews.llvm.org/D13890 llvm-svn: 250822
* Test commitSean Eveson2015-10-161-1/+1
| | | | llvm-svn: 250500
* [analyzer] Don’t invalidate CXXThis when conservatively evaluating const ↵Devin Coughlin2015-10-131-6/+29
| | | | | | | | | | | | methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
* Fix Clang-tidy modernize-use-nullptr warnings in source directories; other ↵Hans Wennborg2015-10-061-8/+10
| | | | | | | | | | minor cleanups Patch by Eugene Zelenko! Differential Revision: http://reviews.llvm.org/D13406 llvm-svn: 249484
* SourceRanges are small and trivially copyable, don't them by reference.Craig Topper2015-10-043-7/+5
| | | | llvm-svn: 249259
* Replace double negation of !FileID.isInvalid() with FileID.isValid().Yaron Keren2015-10-031-1/+1
| | | | | | +couple more of double-negated !SourceLocation.isInvalid() unfixed in r249228. llvm-svn: 249235
* [analyzer] Add TK_EntireMemSpace invalidation trait.Devin Coughlin2015-10-011-22/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit supports Sean Eveson's work on loop widening. It is NFC for now. It adds a new TK_EntireMemSpace invalidation trait that, when applied to a MemSpaceRegion, indicates that the entire memory space should be invalidated. Clients can add this trait before invalidating. For example: RegionAndSymbolInvalidationTraits ITraits; ITraits.setTrait(MRMgr.getStackLocalsRegion(STC), RegionAndSymbolInvalidationTraits::TK_EntireMemSpace); This commit updates the existing logic invalidating global memspace regions for calls to additionally handle arbitrary memspaces. When generating initial clusters during cluster analysis we now add a cluster to the worklist if the memspace for its base is marked with TK_EntireMemSpace. This also moves the logic for invalidating globals from ClusterAnalysis to invalidateRegionsWorker so that it is not shared with removeDeadBindingsWorker. There are no explicit tests with this patch -- but when applied to Sean's patch for loop widening in http://reviews.llvm.org/D12358 and after updating his code to set the trait, the failing tests in that patch now pass. Differential Revision: http://reviews.llvm.org/D12993 llvm-svn: 249063
* createUniqueFile() is documented to create the file in the temporary ↵Cameron Esfahani2015-10-011-1/+6
| | | | | | | | | | | | | | | | directory unless it's supplied an absolute path. Make sure the output filepath supplied to createUniqueFile() in HTMLDiagnostics::ReportDiag() is absolute. Summary: Make sure the output filepath supplied to createUniqueFile() in HTMLDiagnostics::ReportDiag() is absolute. Reviewers: rsmith, akyrtzi Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D12774 llvm-svn: 248977
* [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire ↵Devin Coughlin2015-09-242-9/+176
| | | | | | | | | | | | | | | | | | | | region. Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size array fields. With this change, instead of invalidating the entire containing region the analyzer now invalidates only offsets for the array itself when it can show that the memcpy stays within the bounds of the array. This addresses false positive memory leak warnings of the kind reported by krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954 (This is the second attempt, now with assertion failures resolved.) A patch by Pierre Gousseau! Differential Revision: http://reviews.llvm.org/D12571 llvm-svn: 248516
* Drop useless const in for-range loops.Benjamin Kramer2015-09-241-1/+1
| | | | | | | | StringRefs always point to immutable memory so the const doesn't add value here. Also quiets clang's -Wrange-loop-analysis which warns about the implicit copying. llvm-svn: 248496
* [analyzer] Discard malloc-overflow bug-report when a known size is malloc'ed.Devin Coughlin2015-09-231-33/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch ignores malloc-overflow bug in two cases: Case1: x = a/b; where n < b malloc (x*n); Then x*n will not overflow. Case2: x = a; // when 'a' is a known value. malloc (x*n); Also replaced isa with dyn_cast. Reject multiplication by zero cases in MallocOverflowSecurityChecker Currently MallocOverflowSecurityChecker does not catch cases like: malloc(n * 0 * sizeof(int)); This patch rejects such cases. Two test cases added. malloc-overflow2.c has an example inspired from a code in linux kernel where the current checker flags a warning while it should not. A patch by Aditya Kumar! Differential Revision: http://reviews.llvm.org/D9924 llvm-svn: 248446
* [analyzer] Improve localizability checks for iOS / OS X.Devin Coughlin2015-09-232-97/+707
| | | | | | | | | | | | | | | | | | | | Various improvements to the localization checker: * Adjusted copy to be consistent with diagnostic text in other Apple API checkers. * Added in ~150 UIKit / AppKit methods that require localized strings in UnlocalizedStringsChecker. * UnlocalizedStringChecker now checks for UI methods up the class hierarchy and UI methods that conform for a certain Objective-C protocol. * Added in alpha version of PluralMisuseChecker and some regression tests. False positives are still not ideal. (This is the second attempt, with the memory issues on Linux resolved.) A patch by Kulpreet Chilana! Differential Revision: http://reviews.llvm.org/D12417 llvm-svn: 248432
* Revert "[analyzer] Improve localizability checks for iOS / OS X."Devin Coughlin2015-09-232-707/+97
| | | | | | This reverts commit r248350. The pluralization checks are failing on some bots. llvm-svn: 248351
* [analyzer] Improve localizability checks for iOS / OS X.Devin Coughlin2015-09-222-97/+707
| | | | | | | | | | | | | | | | | | Various improvements to the localization checker: * Adjusted copy to be consistent with diagnostic text in other Apple API checkers. * Added in ~150 UIKit / AppKit methods that require localized strings in UnlocalizedStringsChecker. * UnlocalizedStringChecker now checks for UI methods up the class hierarchy and UI methods that conform for a certain Objective-C protocol. * Added in alpha version of PluralMisuseChecker and some regression tests. False positives are still not ideal. A patch by Kulpreet Chilana! Differential Revision: http://reviews.llvm.org/D12417 llvm-svn: 248350
* [analyzer] Make realloc(ptr, 0) handling equivalent to malloc(0).Devin Coughlin2015-09-221-13/+25
| | | | | | | | | | | | | | | | | | Currently realloc(ptr, 0) is treated as free() which seems to be not correct. C standard (N1570) establishes equivalent behavior for malloc(0) and realloc(ptr, 0): "7.22.3 Memory management functions calloc, malloc, realloc: If the size of the space requested is zero, the behavior is implementation-defined: either a null pointer is returned, or the behavior is as if the size were some nonzero value, except that the returned pointer shall not be used to access an object." The patch equalizes the processing of malloc(0) and realloc(ptr,0). The patch also enables unix.Malloc checker to detect references to zero-allocated memory returned by realloc(ptr,0) ("Use of zero-allocated memory" warning). A patch by Антон Ярцев! Differential Revision: http://reviews.llvm.org/D9040 llvm-svn: 248336
* [analyzer] Create one state for a range switch case instead of multiple.Devin Coughlin2015-09-224-75/+248
| | | | | | | | | | | | | This fixes PR16833, in which the analyzer was using large amounts of memory for switch statements with large case ranges. rdar://problem/14685772 A patch by Aleksei Sidorin! Differential Revision: http://reviews.llvm.org/D5102 llvm-svn: 248318
* Analyzer: Teach analyzer how to handle TypeTraitExprIsmail Pazarbasi2015-09-223-2/+8
| | | | | | | | | | | | | | | | | | | | Summary: `TypeTraitExpr`s are not supported by the ExprEngine today. Analyzer creates a sink, and aborts the block. Therefore, certain bugs that involve type traits intrinsics cannot be detected (see PR24710). This patch creates boolean `SVal`s for `TypeTraitExpr`s, which are evaluated by the compiler. Test within the patch is a summary of PR24710. Reviewers: zaks.anna, dcoughlin, krememek Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D12482 llvm-svn: 248314
* [Static Analyzer] Fixed a false positive case in DynamicTypeChecker when ↵Gabor Horvath2015-09-181-0/+11
| | | | | | dealing with forward declarations. llvm-svn: 248065
* Analyzer: Fix a crasher in UbigraphVizIsmail Pazarbasi2015-09-181-2/+3
| | | | | | | | | | | | | | | Summary: Name `Out` refers to the parameter. It is moved into the member `Out` in ctor-init. Dereferencing null pointer will crash clang, if user passes '-analyzer-viz-egraph-ubigraph' argument. Reviewers: zaks.anna, krememek Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D12119 llvm-svn: 248050
* [Static Analyzer] General type checker based on dynamic type information.Gabor Horvath2015-09-184-52/+207
| | | | | | Differential Revision: http://reviews.llvm.org/D12973 llvm-svn: 248041
OpenPOWER on IntegriCloud