summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Ensure that loop widening does not invalidate referencesMatthew Voss2018-06-121-0/+19
| | | | | | | | | | Loop widening can invalidate a reference. If the analyzer attempts to visit the destructor to a non-existent reference, it will crash. This patch ensures that the reference is preserved. https://reviews.llvm.org/D47044 llvm-svn: 334554
* [analyzer] [NFC] Remove "removeInvalidation" from visitor APIGeorge Karpenkov2018-06-121-2/+3
| | | | | | | | | | | removeInvalidation is a very problematic API, as it makes suppression order-dependent. Moreover, it was used only once, and could be rewritten in a much cleaner way. Differential Revision: https://reviews.llvm.org/D48045 llvm-svn: 334542
* [analyzer] [NFC] Move ::dump methods from BugReporter.cpp to PathDiagnostics.cppGeorge Karpenkov2018-06-122-104/+100
| | | | | | | | | | BugReporter.cpp is already severely overloaded, and those dump methods are on PathDiagnostics and should belong in the corresponding implementation file. Differential Revision: https://reviews.llvm.org/D48035 llvm-svn: 334541
* [analyzer] [NFC] Remove most usages of getEndPathGeorge Karpenkov2018-06-122-18/+23
| | | | | | | | | | | | | | | getEndPath is a problematic API, because it's not clear when it's called (hint: not always at the end of the path), it crashes at runtime with more than one non-nullptr returning implementation, and diagnostics internal depend on it being called at some exact place. However, most visitors don't actually need that: all they want is a function consistently called after all nodes are traversed, to perform finalization and to decide whether invalidation is needed. Differential Revision: https://reviews.llvm.org/D48042 llvm-svn: 334540
* Work around false -Wmissing-braces warning from old clang which has been ↵Fangrui Song2018-06-121-1/+1
| | | | | | fixed in r314838 llvm-svn: 334539
* [analyzer] [NFC] Now let's have only one place for diagnostics generationGeorge Karpenkov2018-06-121-43/+15
| | | | | | Differential Revision: https://reviews.llvm.org/D47808 llvm-svn: 334526
* [analyzer] [NFC] Unify Minimal and Extensive diagnostics.George Karpenkov2018-06-121-286/+243
| | | | | | | | | | Once we removed AlternateExtensive, I've looked closer into the difference between Minimal and Extensive, and turns out, the difference was not that large. Differential Revision: https://reviews.llvm.org/D47756 llvm-svn: 334525
* [analyzer] [NFC] Remove unused Extensive diagnostic setting,George Karpenkov2018-06-121-565/+10
| | | | | | | | | | | | | | Rename AlternateExtensive to Extensive. In 2013, five years ago, we have switched to AlternateExtensive diagnostics by default, and Extensive was available under unused, undocumented flag. This change remove the flag, renames the Alternate diagnostic to Extensive (as it's no longer Alternate), and ports the test. Differential Revision: https://reviews.llvm.org/D47670 llvm-svn: 334524
* Refactor ExecuteAndWait to take StringRefs.Zachary Turner2018-06-121-2/+2
| | | | | | | | | | | | | | | | | | | This simplifies some code which had StringRefs to begin with, and makes other code more complicated which had const char* to begin with. In the end, I think this makes for a more idiomatic and platform agnostic API. Not all platforms launch process with null terminated c-string arrays for the environment pointer and argv, but the api was designed that way because it allowed easy pass-through for posix-based platforms. There's a little additional overhead now since on posix based platforms we'll be takign StringRefs which were constructed from null terminated strings and then copying them to null terminate them again, but from a readability and usability standpoint of the API user, I think this API signature is strictly better. llvm-svn: 334518
* [analyzer] Clean up the program state map of DanglingInternalBufferChecker.Reka Kovacs2018-06-091-1/+22
| | | | | | | | | | Symbols are cleaned up from the program state map when they go out of scope. Memory regions are cleaned up when the corresponding object is destroyed, and additionally in 'checkDeadSymbols' in case destructor modeling was incomplete. Differential Revision: https://reviews.llvm.org/D47416 llvm-svn: 334352
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-094-2/+139
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [FileSystem] Split up the OpenFlags enumeration.Zachary Turner2018-06-071-4/+2
| | | | | | | | | | | | | | | | | This breaks the OpenFlags enumeration into two separate enumerations: OpenFlags and CreationDisposition. The first controls the behavior of the API depending on whether or not the target file already exists, and is not a flags-based enum. The second controls more flags-like values. This yields a more easy to understand API, while also allowing flags to be passed to the openForRead api, where most of the values didn't make sense before. This also makes the apis more testable as it becomes easy to enumerate all the configurations which make sense, so I've added many new tests to exercise all the different values. llvm-svn: 334221
* [Analyzer] Fix Z3ConstraintManager crash (PR37646)Vlad Tsyrklevich2018-06-061-2/+4
| | | | | | | | | | | | | | | | Summary: Fix another Z3ConstraintManager crash, use fixAPSInt() to extend a boolean APSInt. Reviewers: george.karpenkov, NoQ, ddcc Reviewed By: george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D47617 llvm-svn: 334065
* [analyzer] Re-enable constructors when lifetime extension through fields occurs.Artem Dergachev2018-06-042-20/+6
| | | | | | | | | | | | | | | | Temporary object constructor inlining was disabled in r326240 for code like const int &x = A().x; because automatic destructor for the lifetime-extended object A() was not working correctly in CFG. CFG was fixed in r333941, so inlining can be re-enabled. CFG for lifetime extension through aggregates still needs to be fixed. Differential Revision: https://reviews.llvm.org/D44239 llvm-svn: 333946
* [analyzer] False positive refutation with Z3Mikhail R. Gadelha2018-06-043-1/+56
| | | | | | | | | | | | | | Summary: This is a prototype of a bug reporter visitor that invalidates bug reports by re-checking constraints of certain states on the bug path using the Z3 constraint manager backend. The functionality is available under the `crosscheck-with-z3` analyzer config flag. Reviewers: george.karpenkov, NoQ, dcoughlin, rnkovacs Reviewed By: george.karpenkov Subscribers: rnkovacs, NoQ, george.karpenkov, dcoughlin, xbolva00, ddcc, mikhail.ramalho, MTC, fhahn, whisperity, baloghadamsoftware, szepet, a.sidorin, gsd, dkrupp, xazax.hun, cfe-commits Differential Revision: https://reviews.llvm.org/D45517 llvm-svn: 333903
* Created a tiny SMT interface and make Z3ConstraintManager implement itMikhail R. Gadelha2018-06-041-3/+58
| | | | | | | | | | | | | | | | | | | Summary: This patch implements a simple SMTConstraintManager API, and requires the implementation of two methods for now: `addRangeConstraints` and `isModelFeasible`. Update Z3ConstraintManager to inherit it and implement required methods. I also moved the method to dump the SMT formula from D45517 to this patch. This patch was created based on the reviews from D47640. Reviewers: george.karpenkov, NoQ, ddcc, dcoughlin Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D47689 llvm-svn: 333899
* Moved RangedConstraintManager header to the StaticAnalyser include dirMikhail R. Gadelha2018-06-043-216/+2
| | | | | | | | | | | | | | | Summary: Moved `RangedConstraintManager` header from `lib/StaticAnalyzer/Core/` to `clang/StaticAnalyzer/Core/PathSensitive/`. No changes to the code. Reviewers: NoQ, george.karpenkov, dcoughlin Reviewed By: george.karpenkov Subscribers: NoQ, george.karpenkov, dcoughlin, ddcc Differential Revision: https://reviews.llvm.org/D47640 llvm-svn: 333862
* [analyzer] NFC: Track all constructed objects in a single state trait.Artem Dergachev2018-06-013-277/+133
| | | | | | | | | | | | | | | ExprEngine already maintains three internal program state traits to track path-sensitive information related to object construction: pointer returned by operator new, and pointer to temporary object for two different purposes - for destruction and for lifetime extension. We'll need to add 2-3 more in a few follow-up commits. Merge these traits into one because they all essentially serve one purpose and work similarly. Differential Revision: https://reviews.llvm.org/D47303 llvm-svn: 333719
* [analyzer] fix bug with 1-bit APSInt types in Z3ConstraintManagerDominic Chen2018-05-311-22/+50
| | | | | | | | | | | | Summary: Clang does not have a corresponding QualType for a 1-bit APSInt, so use the BoolTy and extend the APSInt. Split from D35450. Fixes PR37622. Reviewers: george.karpenkov, NoQ Subscribers: mikhail.ramalho, xazax.hun, szepet, rnkovacs, cfe-commits, a.sidorin Differential Revision: https://reviews.llvm.org/D47603 llvm-svn: 333704
* [analyzer] Improve performance of the SVal simplification mechanism further.Artem Dergachev2018-05-311-6/+31
| | | | | | | | | | | Memoize simplification so that we didn't need to simplify the same symbolic expression twice within the same program state. Gives ~25% performance boost on the artificial test in test/Analysis/hangs.c. Differential Revision: https://reviews.llvm.org/D47402 llvm-svn: 333671
* [analyzer] Improve performance of the SVal simplification mechanism.Artem Dergachev2018-05-311-5/+19
| | | | | | | | | | | | When neither LHS nor RHS of a binary operator expression can be simplified, return the original expression instead of re-evaluating the binary operator. Such re-evaluation was causing recusrive re-simplification which caused the algorithmic complexity to explode. Differential Revision: https://reviews.llvm.org/D47155 llvm-svn: 333670
* [analyzer] Trust _Nonnull annotations, and trust analyzer knowledge about ↵George Karpenkov2018-05-311-5/+43
| | | | | | | | | | | | | | | receiver nullability Previously, the checker was using the nullability of the expression, which is nonnull IFF both receiver and method are annotated as _Nonnull. However, the receiver could be known to the analyzer to be nonnull without being explicitly marked as _Nonnull. rdar://40635584 Differential Revision: https://reviews.llvm.org/D47510 llvm-svn: 333612
* [analyzer] Remove the redundant check about same state transition in ↵Henry Wong2018-05-301-3/+1
| | | | | | | | | | | | | | | | `ArrayBoundCheckerV2.cpp`. Summary: Since the `addTransitionImpl()` has a check about same state transition, there is no need to check it in `ArrayBoundCheckerV2.cpp`. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D47451 llvm-svn: 333531
* [analyzer] const init: handle non-explicit cases more accuratelyRafael Stahl2018-05-291-5/+18
| | | | | | | | | | | | | | Summary: If the access is out of bounds, return UndefinedVal. If it is missing an explicit init, return the implicit zero value it must have. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D46823 llvm-svn: 333417
* [analyzer] Add security checks for bcmp(), bcopy(), bzero().Artem Dergachev2018-05-261-0/+141
| | | | | | | | | | | These functions are obsolete. The analyzer would advice to replace them with memcmp(), memcpy() or memmove(), or memset(). Patch by Tom Rix! Differential Revision: https://reviews.llvm.org/D41881 llvm-svn: 333326
* [analyzer] Added template argument lists to the Pathdiagnostic outputKristof Umann2018-05-251-2/+50
| | | | | | | | | | | Because template parameter lists were not displayed in the plist output, it was difficult to decide in some cases whether a given checker found a true or a false positive. This patch aims to correct this. Differential Revision: https://reviews.llvm.org/D46933 llvm-svn: 333275
* [analyzer] Move RangeSet related declarations into the ↵Mikhail R. Gadelha2018-05-242-236/+256
| | | | | | | | | | | | | | | | | | RangedConstraintManager header. Summary: I could also move `RangedConstraintManager.h` under `include/` if you agree as it seems slightly out of place under `lib/`. Patch by Réka Kovács Reviewers: NoQ, george.karpenkov, dcoughlin, rnkovacs Reviewed By: NoQ Subscribers: mikhail.ramalho, whisperity, xazax.hun, baloghadamsoftware, szepet, a.sidorin, dkrupp, cfe-commits Differential Revision: https://reviews.llvm.org/D45920 llvm-svn: 333179
* [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the ↵David Carlier2018-05-231-1/+5
| | | | | | | | | | | | | | dest buffer Again, strlc* does not return a pointer so the zero size case doest not fit. Reviewers: NoQ, george.karpenkov Reviewed by: NoQ Differential Revision: https://reviews.llvm.org/D47007 llvm-svn: 333060
* [analyzer] Extend ObjCAutoreleaseWriteChecker to catch block declarations ↵George Karpenkov2018-05-161-7/+12
| | | | | | | | with autoreleasing variables Differential Revision: https://reviews.llvm.org/D46984 llvm-svn: 332546
* [analyzer] Change the warning message for GCD antipattern checkerGeorge Karpenkov2018-05-161-2/+2
| | | | llvm-svn: 332544
* [analyzer] Improve the modeling of memset().Henry Wong2018-05-161-3/+99
| | | | | | | | | | | | Since there is no perfect way bind the non-zero value with the default binding, this patch only considers the case where buffer's offset is zero and the char value is 0. And according to the value for overwriting, decide how to update the string length. Reviewers: dcoughlin, NoQ, xazax.hun, a.sidorin, george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D44934 llvm-svn: 332463
* [analyzer] Make plist-html diagnostic consumer produce multi-file reports.Artem Dergachev2018-05-161-1/+1
| | | | | | | | | | | Previously plist-html output produced multi-file HTML reports but only single-file Plist reports. Change plist-html output to produce multi-file Plist reports as well. Differential Revision: https://reviews.llvm.org/D46902 llvm-svn: 332417
* [clang] Update uses of DEBUG macro to LLVM_DEBUG.Nicola Zaghen2018-05-152-6/+6
| | | | | | | | | | | | | The DEBUG() macro is very generic so it might clash with other projects. The renaming was done as follows: - git grep -l 'DEBUG' | xargs sed -i 's/\bDEBUG\s\?(/LLVM_DEBUG(/g' - git diff -U0 master | ../clang/tools/clang-format/clang-format-diff.py -i -p1 -style LLVM Explicitly avoided changing the strings in the clang-format tests. Differential Revision: https://reviews.llvm.org/D44975 llvm-svn: 332350
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-54/+97
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Extend the ObjCAutoreleaseWriteChecker to warn on captures as wellGeorge Karpenkov2018-05-141-29/+51
| | | | | | | | | | A common pattern is that the code in the block does not write into the variable explicitly, but instead passes it to a helper function which performs the write. Differential Revision: https://reviews.llvm.org/D46772 llvm-svn: 332300
* [analyzer] Ignore the nullability quantifiers for autoreleasewritecheckerGeorge Karpenkov2018-05-111-2/+2
| | | | llvm-svn: 332136
* Fixes issue introduced by r331556.Alexander Kornienko2018-05-091-3/+5
| | | | | | | | | | Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357 Patch by Rafael Stahl! Differential revision: https://reviews.llvm.org/D46633 llvm-svn: 331870
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-0920-86/+86
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* Fix a couple places that immediately called operator-> on the result of ↵Craig Topper2018-05-051-1/+1
| | | | | | | | dyn_cast. It looks like it safe to just use cast for both cases. llvm-svn: 331578
* [analyzer] Remove untested code in evalLoad.Artem Dergachev2018-05-041-37/+0
| | | | | | No functional change intended. llvm-svn: 331565
* [analyzer] Invalidate union regions properly. Don't hesitate to load later.Artem Dergachev2018-05-041-6/+1
| | | | | | | | | | | | | | | | | | | We weren't invalidating our unions correctly. The previous behavior in invalidateRegionsWorker::VisitCluster() was to direct-bind an UnknownVal to the union (at offset 0). For that reason we were never actually loading default bindings from our unions, because there never was any default binding to load, and the value that is presumed when there's no default binding to load is usually completely incorrect (eg. UndefinedVal for stack unions). The new behavior is to default-bind a conjured symbol (of irrelevant type) to the union that's being invalidated, similarly to what we do for structures and classes. Then it becomes safe to load the value properly. Differential Revision: https://reviews.llvm.org/D45241 llvm-svn: 331563
* [analyzer] pr36458: Fix retrieved value cast for symbolic void pointers.Artem Dergachev2018-05-041-0/+14
| | | | | | | | | | | | | C allows us to write any bytes into any memory region. When loading weird bytes from memory regions of known types, the analyzer is required to make sure that the loaded value makes sense by casting it to an appropriate type. Fix such cast for loading values that represent void pointers from non-void pointer type places. Differential Revision: https://reviews.llvm.org/D46415 llvm-svn: 331562
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-046-35/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] pr37209: Fix casts of glvalues to references.Artem Dergachev2018-05-041-0/+7
| | | | | | | | | | | | | | | Many glvalue expressions aren't of their respective reference type - they are simply glvalues of their value type. This was causing problems when we were trying to obtain type of the original expression while evaluating certain glvalue bit-casts. Fixed by artificially forging a reference type to provide to the casting procedure. Differential Revision: https://reviews.llvm.org/D46224 llvm-svn: 331558
* [analyzer] Treat more const variables and fields as known contants.Artem Dergachev2018-05-042-3/+52
| | | | | | | | | | | | | | | | When loading from a variable or a field that is declared as constant, the analyzer will try to inspect its initializer and constant-fold it. Upon success, the analyzer would skip normal load and return the respective constant. The new behavior also applies to fields/elements of brace-initialized structures and arrays. Patch by Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45774 llvm-svn: 331556
* [analyzer] NFC: Remove unused parameteer of StoreManager::CastRetrievedVal().Artem Dergachev2018-05-042-17/+5
| | | | llvm-svn: 331496
* Track the result of evaluating a computed noexcept specification on theRichard Smith2018-05-031-2/+2
| | | | | | | | | | | | | | FunctionProtoType. We previously re-evaluated the expression each time we wanted to know whether the type is noexcept or not. We now evaluate the expression exactly once. This is not quite "no functional change": it fixes a crasher bug during AST deserialization where we would try to evaluate the noexcept specification in a situation where we have not deserialized sufficient portions of the AST to permit such evaluation. llvm-svn: 331428
* [analyzer] Revert r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-021-39/+2
| | | | | | | | | The return values of the newly supported functions were not handled correctly: strlcpy()/strlcat() return string sizes rather than pointers. Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331401
* [analyzer] Fix filename in cross-file HTML reportMalcolm Parsons2018-05-021-1/+3
| | | | | | | | | | | | | | | | | Summary: The filename is currently taken from the start of the path, while the line and column are taken from the end of the path. This didn't matter until cross-file path reporting was added. Reviewers: george.karpenkov, dcoughlin, vlad.tsyrklevich Reviewed By: george.karpenkov, vlad.tsyrklevich Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D45611 llvm-svn: 331361
* [analyzer] Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero and VLASize.Henry Wong2018-05-023-25/+31
| | | | | | | | | | | | | | Summary: Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero, VLASize to be able to indicate where the taint information originated from. Reviewers: NoQ, george.karpenkov, xazax.hun, a.sidorin Reviewed By: NoQ Subscribers: szepet, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D46007 llvm-svn: 331345
OpenPOWER on IntegriCloud