summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer][UninitializedObjectChecker] Reports Loc fields pointing to themselvesKristof Umann2018-10-111-19/+49
| | | | | | | | | | | I've added a new functionality, the checker is now able to detect and report fields pointing to themselves. I figured this would fit well into the checker as there's no reason for a pointer to point to itself instead of being nullptr. Differential Revision: https://reviews.llvm.org/D51305 llvm-svn: 344242
* [analyzer] Support Reinitializes attribute in MisusedMovedObject checkGabor Horvath2018-10-091-14/+10
| | | | | | Differential Revision: https://reviews.llvm.org/D52983 llvm-svn: 344017
* [analyzer] Do not crash if the assumption added in TrustNonNullChecker is ↵George Karpenkov2018-10-031-8/+14
| | | | | | | | | | enough to make the state unfeasible rdar://43541814 Differential Revision: https://reviews.llvm.org/D52848 llvm-svn: 343735
* [analyzer] Fix symbol discovery in nonloc::LocAsInteger values.Artem Dergachev2018-10-021-1/+1
| | | | | | | | | Doesn't do much despite sounding quite bad, but fixes an exotic test case where liveness of a nonloc::LocAsInteger array index is now evaluated correctly. Differential Revision: https://reviews.llvm.org/D52667 llvm-svn: 343631
* [analyzer][NFC] Refactor functions in PlistDiagnostics to take ↵Kristof Umann2018-10-021-23/+34
| | | | | | | | | | | | | AnalyzerOptions as parameter I intend to add a new flag macro-expnasions-as-events, and unfortunately I'll only be able to convert the macro piece into an event one once I'm about to emit it, due to the lack of an avaible Preprocessor object in the BugReporter. Differential Revision: https://reviews.llvm.org/D52787 llvm-svn: 343620
* [analyzer] Improvements to the SMT APIMikhail R. Gadelha2018-10-022-38/+12
| | | | | | | | | | | | | | | | | | | | | | | | | Summary: Several improvements in preparation for the new backends. Refactoring: - Removed duplicated methods `fromBoolean`, `fromAPSInt`, `fromInt` and `fromAPFloat`. The methods `mkBoolean`, `mkBitvector` and `mkFloat` are now used instead. - The names of the functions that convert BVs to FPs were swapped (`mkSBVtoFP`, `mkUBVtoFP`, `mkFPtoSBV`, `mkFPtoUBV`). - Added a couple of comments in function calls. Crosscheck encoding: - Changed how constraints are encoded in the refutation manager so it doesn't start with (false OR ...). This change introduces one duplicated line (see file `BugReporterVisitors.cpp`, the `SMTConv::getRangeExpr is called twice, so I can remove this change if the duplication is a problem. Reviewers: george.karpenkov, NoQ Reviewed By: george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin, Szelethus Differential Revision: https://reviews.llvm.org/D52365 llvm-svn: 343581
* Revert untintentionally commited changesEric Liu2018-10-021-3/+3
| | | | llvm-svn: 343574
* [Lex] TokenConcatenation now takes const PreprocessorEric Liu2018-10-021-3/+3
| | | | | | Differential Revision: https://reviews.llvm.org/D52502 llvm-svn: 343573
* [analyzer][NFC] Refactor functions in PlistDiagnostics to take Preproc as ↵Kristof Umann2018-10-011-71/+72
| | | | | | | | | | parameter This is patch is a preparation for the proposed inclusion of macro expansions in the plist output. Differential Revision: https://reviews.llvm.org/D52735 llvm-svn: 343511
* [analyzer] [NFC] Remove unused parameters, as found by -Wunused-parameterGeorge Karpenkov2018-09-2828-175/+104
| | | | | | Differential Revision: https://reviews.llvm.org/D52640 llvm-svn: 343353
* [analyzer] Provide an option to dump generated exploded graphs to a given file.George Karpenkov2018-09-282-5/+33
| | | | | | | | | | | Dumping graphs instead of opening them is often very useful, e.g. for transfer or converting to SVG. Basic sanity check for generated exploded graphs. Differential Revision: https://reviews.llvm.org/D52637 llvm-svn: 343352
* [analyzer] Hotfix for the bug in exploded graph printingGeorge Karpenkov2018-09-271-0/+2
| | | | llvm-svn: 343276
* [analyzer] Highlight nodes which have error reports in them in red in ↵George Karpenkov2018-09-271-25/+65
| | | | | | | | exploded graph Differential Revision: https://reviews.llvm.org/D52584 llvm-svn: 343239
* Revert untintentionally commited changesKristof Umann2018-09-271-3/+3
| | | | llvm-svn: 343205
* [Lex] TokenConcatenation now takes const PreprocessorKristof Umann2018-09-271-3/+3
| | | | | | Differential Revision: https://reviews.llvm.org/D52502 llvm-svn: 343204
* [analyzer] [NFC] Move the code for dumping the program point to ProgramPointGeorge Karpenkov2018-09-271-179/+1
| | | | | | | | So we can dump them outside of viewing the exploded grpah. Differential Revision: https://reviews.llvm.org/D52583 llvm-svn: 343160
* [analyzer] [NFC] Heavy refactoring of trackNullOrUndefValueGeorge Karpenkov2018-09-271-117/+56
| | | | | | Differential Revision: https://reviews.llvm.org/D52519 llvm-svn: 343159
* llvm::sort(C.begin(), C.end(), ...) -> llvm::sort(C, ...)Fangrui Song2018-09-263-6/+5
| | | | | | | | | | | | | | Summary: The convenience wrapper in STLExtras is available since rL342102. Reviewers: rsmith, #clang, dblaikie Reviewed By: rsmith, #clang Subscribers: mgrang, arphaman, kadircet, cfe-commits Differential Revision: https://reviews.llvm.org/D52576 llvm-svn: 343147
* Removed extra semicolon to fix Wpedantic. (NFCI).Simon Pilgrim2018-09-261-1/+1
| | | | llvm-svn: 343085
* [analyzer] Fix a crash on casting symbolic pointers to derived classes.Artem Dergachev2018-09-261-1/+11
| | | | | | | | | | | Commit r340984 causes a crash when a pointer to a completely unrelated type UnrelatedT (eg., opaque struct pattern) is being casted from base class BaseT to derived class DerivedT, which results in an ill-formed region Derived{SymRegion{$<UnrelatedT x>}, DerivedT}. Differential Revision: https://reviews.llvm.org/D52189 llvm-svn: 343051
* [analyzer] Add a testing facility for testing relationships between symbols.Artem Dergachev2018-09-251-0/+98
| | | | | | | | | | | | | | | | | | Tests introduced in r329780 was disabled in r342317 because these tests were accidentally testing dump infrastructure, when all they cared about was how symbols relate to each other. So when dump infrastructure changed, tests became annoying to maintain. Add a new feature to ExprInspection: clang_analyzer_denote() and clang_analyzer_explain(). The former adds a notation to a symbol, the latter expresses another symbol in terms of previously denoted symbols. It's currently a bit wonky - doesn't print parentheses and only supports denoting atomic symbols. But it's even more readable that way. Differential Revision: https://reviews.llvm.org/D52133 llvm-svn: 343048
* [analyzer] NFC: CallDescription: Improve array management.Artem Dergachev2018-09-251-7/+10
| | | | | | | | | | Combine the two constructor overrides into a single ArrayRef constructor to allow easier brace initializations and simplify how the respective field is used internally. Differential Revision: https://reviews.llvm.org/D51390 llvm-svn: 343037
* [analyzer] NFC: Legalize state manager factory injection.Artem Dergachev2018-09-253-26/+4
| | | | | | | | | | | | | | | | | | | | | When a checker maintains a program state trait that isn't a simple list/set/map, but is a combination of multiple lists/sets/maps (eg., a multimap - which may be implemented as a map from something to set of something), ProgramStateManager only contains the factory for the trait itself. All auxiliary lists/sets/maps need a factory to be provided by the checker, which is annoying. So far two checkers wanted a multimap, and both decided to trick the ProgramStateManager into keeping the auxiliary factory within itself by pretending that it's some sort of trait they're interested in, but then never using this trait but only using the factory. Make this trick legal. Define a convenient macro. One thing that becomes apparent once all pieces are put together is that these two checkers are in fact using the same factory, because the type that identifies it, ImmutableMap<const MemRegion *, ImmutableSet<SymbolRef>>, is the same. This situation is different from two checkers registering similar primitive traits. Differential Revision: https://reviews.llvm.org/D51388 llvm-svn: 343035
* [analyzer] Prevent crashes in FindLastStoreBRVisitorGeorge Karpenkov2018-09-241-4/+13
| | | | | | | | | | This patch is a band-aid. A proper solution would be too change trackNullOrUndefValue to only try to dereference the pointer when it is relevant to the problem. Differential Revision: https://reviews.llvm.org/D52435 llvm-svn: 342920
* [analyzer][UninitializedObjectChecker] Using the new const methods of ↵Kristof Umann2018-09-232-20/+10
| | | | | | | | ImmutableList Differential Revision: https://reviews.llvm.org/D51886 llvm-svn: 342834
* [CStringSyntaxChecker] Check strlcat sizeof checkDavid Carlier2018-09-231-10/+34
| | | | | | | | | | | | | Assuming strlcat is used with strlcpy we check as we can if the last argument does not equal os not larger than the buffer. Advising the proper usual pattern. Reviewers: george.karpenkov, NoQ, MaskRay Reviewed By: MaskRay Differential Revision: https://reviews.llvm.org/D49722 llvm-svn: 342832
* [analyzer] Process state in checkEndFunction in RetainCountCheckerGeorge Karpenkov2018-09-212-44/+57
| | | | | | | | | | | | | | Modify the RetainCountChecker to perform state "adjustments" in checkEndFunction, as performing work in PreStmt<ReturnStmt> does not work with destructors. The previous version made an implicit assumption that no code runs after the return statement is executed. rdar://43945028 Differential Revision: https://reviews.llvm.org/D52338 llvm-svn: 342770
* [analyzer] Highlight sink nodes in redGeorge Karpenkov2018-09-211-0/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D52337 llvm-svn: 342769
* [analyzer] Associate diagnostics created in checkEndFunction with a return ↵George Karpenkov2018-09-213-10/+26
| | | | | | | | | | statement, if possible If not possible, use the last line of the declaration, as before. Differential Revision: https://reviews.llvm.org/D52326 llvm-svn: 342768
* [analyzer] [NFC] Prefer make_unique over "new"George Karpenkov2018-09-211-14/+11
| | | | | | Differential Revision: https://reviews.llvm.org/D52336 llvm-svn: 342767
* [analyzer] Fix bug in isInevitablySinkingGeorge Karpenkov2018-09-211-8/+7
| | | | | | | | | | | | If the non-sink report is generated at the exit node, it will be suppressed by the current functionality in isInevitablySinking, as it only checks the successors of the block, but not the block itself. The bug shows up in RetainCountChecker checks. Differential Revision: https://reviews.llvm.org/D52284 llvm-svn: 342766
* [analyzer] [NFC] Dead code removalGeorge Karpenkov2018-09-212-16/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D52269 llvm-svn: 342765
* [analyzer] ExplodedGraph printing fixesGeorge Karpenkov2018-09-172-44/+24
| | | | | | | | | | | | | Fixes a number of issues: - Global variables are not used for communication - Trait should be defined on a graph, not on a node - Defining the trait on a graph allows us to use a correct allocator, no longer crashing while printing trimmed graphs Differential Revision: https://reviews.llvm.org/D52183 llvm-svn: 342413
* [analyzer] Further printing improvements: use declarations,George Karpenkov2018-09-154-14/+15
| | | | | | | | skip pointers whenever redundant, use unique prefixes. Differential Revision: https://reviews.llvm.org/D52114 llvm-svn: 342316
* [analyzer] Generate and use stable identifiers for LocationContextGeorge Karpenkov2018-09-151-2/+2
| | | | | | | | | | Those are not created in the allocator. Since they are created fairly rarely, a counter overhead should not affect the memory consumption. Differential Revision: https://reviews.llvm.org/D51827 llvm-svn: 342314
* [analyzer] Dump reproducible identifiers for statements in exploded graph in ↵George Karpenkov2018-09-153-12/+17
| | | | | | | | store Differential Revision: https://reviews.llvm.org/D51826 llvm-svn: 342313
* [analyzer] Use correct end-of-line character when printing statements for ↵George Karpenkov2018-09-151-4/+7
| | | | | | | | | | exploded graph Prevents bad centering. Differential Revision: https://reviews.llvm.org/D51825 llvm-svn: 342312
* [analyzer] Dump unique identifiers for statements in exploded graphGeorge Karpenkov2018-09-151-18/+13
| | | | | | Differential Revision: https://reviews.llvm.org/D51823 llvm-svn: 342310
* [analyzer] Skip printing duplicate nodes, even if nodes have multiple ↵George Karpenkov2018-09-151-1/+6
| | | | | | | | | | predecessors/successors Still generate a node, but leave the redundant field empty. Differential Revision: https://reviews.llvm.org/D51821 llvm-svn: 342308
* [analyzer] Restore final on NeedsCastLocField. NFCIlya Biryukov2018-09-141-1/+1
| | | | | | To fix compiler warning about non-virtual dtor introduced in r342221. llvm-svn: 342225
* [analyzer][UninitializedObjectChecker] Support for nonloc::LocAsIntegerKristof Umann2018-09-142-14/+23
| | | | | | Differential Revision: https://reviews.llvm.org/D49437 llvm-svn: 342221
* [analyzer][UninitializedObjectChecker] New flag to ignore records based on ↵Kristof Umann2018-09-142-5/+39
| | | | | | | | | | | | | | | | | it's fields Based on a suggestion from @george.karpenkov. In some cases, structs are used as unions with a help of a tag/kind field. This patch adds a new string flag (a pattern), that is matched against the fields of a record, and should a match be found, the entire record is ignored. For more info refer to http://lists.llvm.org/pipermail/cfe-dev/2018-August/058906.html and to the responses to that, especially http://lists.llvm.org/pipermail/cfe-dev/2018-August/059215.html. Differential Revision: https://reviews.llvm.org/D51680 llvm-svn: 342220
* [analyzer][UninitializedObjectChecker] Refactored checker optionsKristof Umann2018-09-143-59/+63
| | | | | | | | | | | | | Since I plan to add a number of new flags, it made sense to encapsulate them in a new struct, in order not to pollute FindUninitializedFields's constructor with new boolean options with super long names. This revision practically reverts D50508, since FindUninitializedFields now accesses the pedantic flag anyways. Differential Revision: https://reviews.llvm.org/D51679 llvm-svn: 342219
* [analyzer][UninitializedObjectChecker] Correct dynamic type is acquired for ↵Kristof Umann2018-09-141-0/+8
| | | | | | | | record pointees Differential Revision: https://reviews.llvm.org/D50892 llvm-svn: 342217
* [analyzer][UninitializedObjectChecker] Updated commentsKristof Umann2018-09-143-74/+67
| | | | | | | | | | | | | Some of the comments are incorrect, imprecise, or simply nonexistent. Since I have a better grasp on how the analyzer works, it makes sense to update most of them in a single swoop. I tried not to flood the code with comments too much, this amount feels just right to me. Differential Revision: https://reviews.llvm.org/D51417 llvm-svn: 342215
* [analyzer][UninitializedObjectChecker] Fixed dereferencingKristof Umann2018-09-143-77/+86
| | | | | | | | | | iThis patch aims to fix derefencing, which has been debated for months now. Instead of working with SVals, the function now relies on TypedValueRegion. Differential Revision: https://reviews.llvm.org/D51057 llvm-svn: 342213
* [Analyzer] Iterator Checker - Part 8: Support for assign, clear, insert, ↵Adam Balogh2018-09-101-2/+354
| | | | | | | | | | emplace and erase operations This patch adds support for the following operations in the iterator checkers: assign, clear, insert, insert_after, emplace, emplace_after, erase and erase_after. This affects mismatched iterator checks ("this" and parameter must match) and invalidation checks (according to the standard). Differential Revision: https://reviews.llvm.org/D32904 llvm-svn: 341794
* [Analyzer] Iterator Checker - Part 7: Support for push and pop operationsAdam Balogh2018-09-101-0/+312
| | | | | | | | This patch adds support for the following operations in the iterator checkers: push_back, push_front, emplace_back, emplace_front, pop_back and pop_front. This affects iterator range checks (range is extended after push and emplace and reduced after pop operations) and invalidation checks (according to the standard). Differential Revision: https://reviews.llvm.org/D32902 llvm-svn: 341793
* [Analyzer] Iterator Checker - Part 6: Mismatched iterator checker for ↵Adam Balogh2018-09-101-1/+60
| | | | | | | | | | constructors and comparisons Extension of the mismatched iterator checker for constructors taking range of first..last (first and last must be iterators of the same container) and also for comparisons of iterators of different containers (one does not compare iterators of different containers, since the set of iterators is partially ordered, there are no relations between iterators of different containers, except that they are always non-equal). Differential Revision: https://reviews.llvm.org/D32860 llvm-svn: 341792
* [Analyzer] Iterator Checker - Part 5: Move Assignment of ContainersAdam Balogh2018-09-101-6/+153
| | | | | | | | If a container is moved by its move assignment operator, according to the standard all their iterators except the past-end iterators remain valid but refer to the new container. This patch introduces support for this case in the iterator checkers. Differential Revision: https://reviews.llvm.org/D32859 llvm-svn: 341791
OpenPOWER on IntegriCloud