summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
...
* Reland "[Attr] Fix parameter indexing for several attributes"Joel E. Denny2018-03-132-8/+10
| | | | | | | | | Relands r326602 (reverted in r326862) with new test and fix for PR36620. Differential Revision: https://reviews.llvm.org/D43248 llvm-svn: 327405
* [analyzer] Support temporaries conjured by conservatively evaluated functions.Artem Dergachev2018-03-121-14/+30
| | | | | | | | | | | | | | Properly perform destruction and lifetime extension of such temporaries. C++ object-type return values of conservatively evaluated functions are now represented as compound values of well-defined temporary object regions. The function creates a region that represents the temporary object and will later be used for destruction or materialization, invalidates it, and returns the invalidated compound value of the object. Differential Revision: https://reviews.llvm.org/D44131 llvm-svn: 327348
* [analyzer] NFC: Move the code for setting temp object lifetime into method.Artem Dergachev2018-03-122-61/+61
| | | | | | Differential Revision: https://reviews.llvm.org/D44129 llvm-svn: 327347
* [analyzer] Destroy and lifetime-extend inlined function return values properly.Artem Dergachev2018-03-121-29/+58
| | | | | | | | | | | | | | | This patch uses the newly added CFGCXXRecordTypedCall element at the call site of the caller to construct the return value within the callee directly into the caller's stack frame. This way it is also capable of populating the temporary destructor and lifetime extension maps for the temporary, which allows temporary destructors and lifetime extension to work correctly. This patch does not affect temporaries that were returned from conservatively evaluated functions. Differential Revision: https://reviews.llvm.org/D44124 llvm-svn: 327345
* [CFG] [analyzer] Add construction context to C++ return-by-value call elements.Artem Dergachev2018-03-122-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new CFGStmt sub-class, CFGCXXRecordTypedCall, which replaces the regular CFGStmt for the respective CallExpr whenever the CFG has additional information to provide regarding the lifetime of the returned value. This additional call site information is represented by a ConstructionContext (which was previously used for CFGConstructor elements) that provides references to CXXBindTemporaryExpr and MaterializeTemporaryExpr that surround the call. This corresponds to the common C++ calling convention solution of providing the target address for constructing the return value as an auxiliary implicit argument during function call. One of the use cases for such extra context at the call site would be to perform any sort of inter-procedural analysis over the CFG that involves functions returning objects by value. In this case the elidable constructor at the return site would construct the object explained by the context at the call site, and its lifetime would also be managed by the caller, not the callee. The extra context would also be useful for properly handling the return-value temporary at the call site, even if the callee is not being analyzed inter-procedurally. Differential Revision: https://reviews.llvm.org/D44120 llvm-svn: 327343
* [analyzer] Move the GCDAsyncSemaphoreChecker to optin.performanceGeorge Karpenkov2018-03-122-19/+26
| | | | | | | | rdar://38383753 Differential Revision: https://reviews.llvm.org/D44228 llvm-svn: 327309
* [analyzer] Add scope information to CFGMaxim Ostapenko2018-03-124-0/+12
| | | | | | | | | | | This patch adds two new CFG elements CFGScopeBegin and CFGScopeEnd that indicate when a local scope begins and ends respectively. We use first VarDecl declared in a scope to uniquely identify it and add CFGScopeBegin and CFGScopeEnd elements into corresponding basic blocks. Differential Revision: https://reviews.llvm.org/D16403 llvm-svn: 327258
* [analyzer] MmapWriteExecChecker: Add support for mprotect().Artem Dergachev2018-03-091-3/+4
| | | | | | | | | | | mprotect() allows setting memory access flags similarly to mmap(), causing similar security issues if these flags are needlessly broad. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D44250 llvm-svn: 327098
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-082-188/+200
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 327074
* [analyzer] Correctly model iteration through "nil" objectsGeorge Karpenkov2018-03-081-39/+55
| | | | | | | | | | | | | | | | | | | | Previously, iteration through nil objects which resulted from objc-messages being set to nil were modeled incorrectly. There are a couple of notes about this patch: In principle, ExprEngineObjC might be left untouched IFF osx.loops checker is enabled. I however think that we should not do something completely incorrect depending on what checkers are left on. We should evaluate and potentially remove altogether the isConsumedExpr performance heuristic, as it seems very fragile. rdar://22205149 Differential Revision: https://reviews.llvm.org/D44178 llvm-svn: 326982
* Fix an unused variable warning; NFCGeorge Burgess IV2018-03-081-1/+1
| | | | llvm-svn: 326980
* [analyzer] [PointerArithChecker] do not warn on indexes into vector typesGeorge Karpenkov2018-03-071-0/+4
| | | | | | | | rdar://35041502 Differential Revision: https://reviews.llvm.org/D44172 llvm-svn: 326952
* [analyzer] Don't crash with assertion failure on structured bindingsGeorge Karpenkov2018-03-071-1/+6
| | | | | | | | | | | | Proper modeling still remains to be done. Note that BindingDecl#getHoldingVar() is almost always null, and this should probably be handled by dealing with DecompositionDecl beforehand. rdar://36852163 Differential Revision: https://reviews.llvm.org/D44183 llvm-svn: 326951
* [analyzer] [NFC] Minor refactoring of NonNullParamCheckerGeorge Karpenkov2018-03-071-68/+65
| | | | | | Differential Revision: https://reviews.llvm.org/D43917 llvm-svn: 326935
* [analyzer] Fix the checker for the performance anti-pattern to accept messagesGeorge Karpenkov2018-03-071-11/+14
| | | | | | | | send to ObjC objects. Differential Revision: https://reviews.llvm.org/D44170 llvm-svn: 326868
* Revert r326602, it caused PR36620.Nico Weber2018-03-072-10/+8
| | | | llvm-svn: 326862
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-072-188/+190
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326856
* [analyzer] CStringChecker.cpp: Remove the duplicated check about null ↵Henry Wong2018-03-061-21/+0
| | | | | | | | | | | | | | | | dereference on dest-buffer or src-buffer. Summary: `CheckBufferAccess()` calls `CheckNonNull()`, so there are some calls to `CheckNonNull()` that are useless. Reviewers: dcoughlin, NoQ, xazax.hun, cfe-commits, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, MTC, a.sidorin Differential Revision: https://reviews.llvm.org/D44075 llvm-svn: 326782
* [Analyzer] More accurate modeling about the increment operator of the ↵Henry Wong2018-03-061-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operand with type bool. Summary: There is a problem with analyzer that a wrong value is given when modeling the increment operator of the operand with type bool. After `rL307604` is applied, a unsigned overflow may occur. Example: ``` void func() { bool b = true; // unsigned overflow occur, 2 -> 0 U1b b++; } ``` The use of an operand of type bool with the ++ operators is deprecated but valid untill C++17. And if the operand of the increment operator is of type bool, it is set to true. This patch includes two parts: - If the operand of the increment operator is of type bool or type _Bool, set to true. - Modify `BasicValueFactory::getTruthValue()`, use `getIntWidth()` instead `getTypeSize()` and use `unsigned` instead `signed`. Reviewers: alexshap, NoQ, dcoughlin, george.karpenkov Reviewed By: NoQ Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D43741 llvm-svn: 326776
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-063-53/+84
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326757
* [analyzer] [quickfix] Prevent a crash in NamedDecl::getName()George Karpenkov2018-03-061-2/+4
| | | | llvm-svn: 326755
* [analyzer] AST-matching checker to detect global central dispatch ↵George Karpenkov2018-03-052-0/+155
| | | | | | | | | | | | | performance anti-pattern rdar://37312818 NB: The checker does not care about the ordering of callbacks, see the relevant FIXME in tests. Differential Revision: https://reviews.llvm.org/D44059 llvm-svn: 326746
* [analyzer] Improves the logic of GenericTaintChecker identifying stdin.Henry Wong2018-03-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: GenericTaintChecker can't recognize stdin in some cases. The reason is that `if (PtrTy->getPointeeType() == C.getASTContext().getFILEType()` does not hold when stdin is encountered. My platform is ubuntu16.04 64bit, gcc 5.4.0, glibc 2.23. The definition of stdin is as follows: ``` __BEGIN_NAMESPACE_STD /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE FILE; ___END_NAMESPACE_STD ... /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE __FILE; ... /* Standard streams. */ extern struct _IO_FILE *stdin; /* Standard input stream. */ extern struct _IO_FILE *stdout; /* Standard output stream. */ extern struct _IO_FILE *stderr; /* Standard error output stream. */ ``` The type of stdin is as follows AST: ``` ElaboratedType 0xc911170'struct _IO_FILE'sugar `-RecordType 0xc911150'struct _IO_FILE' `-CXXRecord 0xc923ff0'_IO_FILE' ``` `C.getASTContext().GetFILEType()` is as follows AST: ``` TypedefType 0xc932710 'FILE' sugar |-Typedef 0xc9111c0 'FILE' `-ElaboratedType 0xc911170 'struct _IO_FILE' sugar `-RecordType 0xc911150 'struct _IO_FILE' `-CXXRecord 0xc923ff0 '_IO_FILE' ``` So I think it's better to use `getCanonicalType()`. Reviewers: zaks.anna, NoQ, george.karpenkov, a.sidorin Reviewed By: zaks.anna, a.sidorin Subscribers: a.sidorin, cfe-commits, xazax.hun, szepet, MTC Differential Revision: https://reviews.llvm.org/D39159 llvm-svn: 326709
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-023-136/+149
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326633
* [analyzer] Don't throw NSNumberObjectConversion warning on object ↵George Karpenkov2018-03-021-2/+4
| | | | | | | | | | | | | | | initialization in if-expression ``` if (NSNumber* x = ...) ``` is a reasonable pattern in objc++, we should not warn on it. rdar://35152234 Differential Revision: https://reviews.llvm.org/D44044 llvm-svn: 326619
* [Attr] Fix parameter indexing for several attributesJoel E. Denny2018-03-022-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch fixes a number of bugs related to parameter indexing in attributes: * Parameter indices in some attributes (argument_with_type_tag, pointer_with_type_tag, nonnull, ownership_takes, ownership_holds, and ownership_returns) are specified in source as one-origin including any C++ implicit this parameter, were stored as zero-origin excluding any this parameter, and were erroneously printing (-ast-print) and confusingly dumping (-ast-dump) as the stored values. * For alloc_size, the C++ implicit this parameter was not subtracted correctly in Sema, leading to assert failures or to silent failures of __builtin_object_size to compute a value. * For argument_with_type_tag, pointer_with_type_tag, and ownership_returns, the C++ implicit this parameter was not added back to parameter indices in some diagnostics. This patch fixes the above bugs and aims to prevent similar bugs in the future by introducing careful mechanisms for handling parameter indices in attributes. ParamIdx stores a parameter index and is designed to hide the stored encoding while providing accessors that require each use (such as printing) to make explicit the encoding that is needed. Attribute declarations declare parameter index arguments as [Variadic]ParamIdxArgument, which are exposed as ParamIdx[*]. This patch rewrites all attribute arguments that are processed by checkFunctionOrMethodParameterIndex in SemaDeclAttr.cpp to be declared as [Variadic]ParamIdxArgument. The only exception is xray_log_args's argument, which is encoded as a count not an index. Differential Revision: https://reviews.llvm.org/D43248 llvm-svn: 326602
* [analyzer] Prevent crashing in NonNullParamCheckerGeorge Karpenkov2018-03-021-0/+2
| | | | | | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=36381 rdar://37543426 Turns out, the type passed for the lambda capture was incorrect. One more argument to abandon the getSVal overload which does not require the type information. Differential Revision: https://reviews.llvm.org/D43925 llvm-svn: 326520
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-03-021-203/+202
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326519
* [analyzer] Enable cfg-temporary-dtors by default.Artem Dergachev2018-03-011-2/+2
| | | | | | | | | | | | Don't enable c++-temp-dtor-inlining by default yet, due to this reference counting pointe problem. Otherwise the new mode seems stable and allows us to incrementally fix C++ problems in much less hacky ways. Differential Revision: https://reviews.llvm.org/D43804 llvm-svn: 326461
* Resubmit [analyzer] Support for naive cross translation unit analysisIlya Biryukov2018-03-017-12/+77
| | | | | | | | | | | Originally submitted as r326323 and r326324. Reverted in r326432. Reverting the commit was a mistake. The breakage was due to invalid build files in our internal buildsystem, CMakeLists did not have any cyclic dependencies. llvm-svn: 326439
* Revert "[analyzer] Support for naive cross translation unit analysis"Ilya Biryukov2018-03-017-77/+12
| | | | | | | | | | Also revert "[analyzer] Fix a compiler warning" This reverts commits r326323 and r326324. Reason: the commits introduced a cyclic dependency in the build graph. This happens to work with cmake, but breaks out internal integrate. llvm-svn: 326432
* Remove redundant casts. NFCGeorge Burgess IV2018-03-016-13/+13
| | | | | | | | | | | | | | | | | | | So I wrote a clang-tidy check to lint out redundant `isa`, `cast`, and `dyn_cast`s for fun. This is a portion of what it found for clang; I plan to do similar cleanups in LLVM and other subprojects when I find time. Because of the volume of changes, I explicitly avoided making any change that wasn't highly local and obviously correct to me (e.g. we still have a number of foo(cast<Bar>(baz)) that I didn't touch, since overloading is a thing and the cast<Bar> did actually change the type -- just up the class hierarchy). I also tried to leave the types we were cast<>ing to somewhere nearby, in cases where it wasn't locally obvious what we were dealing with before. llvm-svn: 326416
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-03-012-0/+88
| | | | | | | | | | | | | | | | | | | This is a security check that warns when both PROT_WRITE and PROT_EXEC are set during mmap(). If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Re-applied after a revert in r324167. Temporarily stays in the alpha package because it needs a better way of determining macro values that are not immediately available in the AST. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 326405
* [analyzer] Support for naive cross translation unit analysisGabor Horvath2018-02-287-12/+77
| | | | | | | | | | | | | | | | | | The aim of this patch is to be minimal to enable incremental development of the feature on the top of the tree. This patch should be an NFC when the feature is turned off. It is turned off by default and still considered as experimental. Technical details are available in the EuroLLVM Talk: http://llvm.org/devmtg/2017-03//2017/02/20/accepted-sessions.html#7 Note that the initial prototype was done by A. Sidorin et al.: http://lists.llvm.org/pipermail/cfe-dev/2015-October/045730.html Contributions to the measurements and the new version of the code: Peter Szecsi, Zoltan Gera, Daniel Krupp, Kareem Khazem. Differential Revision: https://reviews.llvm.org/D30691 llvm-svn: 326323
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-02-285-83/+132
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326292
* [analyzer] UndefinedAssignmentChecker: Better warning message in implicit ctors.Artem Dergachev2018-02-271-6/+25
| | | | | | | | | | | | | | | | | | When a class forgets to initialize a field in the constructor, and then gets copied around, a warning is emitted that the value assigned to a specific field is undefined. When the copy/move constructor is implicit (not written out in the code) but not trivial (is not a trivial memory copy, eg. because members have an explicit copy constructor), the body of such constructor is auto-generated in the AST. In this case the checker's warning message is squeezed at the top of the class declaration, and it gets hard to guess which field is at fault. Fix the warning message to include the name of the field. Differential Revision: https://reviews.llvm.org/D43798 llvm-svn: 326258
* [analyzer] MallocChecker: Suppress false positives in shared pointers.Artem Dergachev2018-02-271-7/+56
| | | | | | | | | | | | | | | | | | Throw away MallocChecker warnings that occur after releasing a pointer within a destructor (or its callees) after performing C11 atomic fetch_add or fetch_sub within that destructor (or its callees). This is an indication that the destructor's class is likely a reference-counting pointer. The analyzer is not able to understand that the original reference count is usually large enough to avoid most use-after-frees. Even when the smart pointer is a local variable, we still have these false positives that this patch suppresses, because the analyzer doesn't currently support atomics well enough. Differential Revision: https://reviews.llvm.org/D43791 llvm-svn: 326249
* [analyzer] Fix trivial copy for empty objects.Artem Dergachev2018-02-271-0/+11
| | | | | | | | | | | | | | The SVal for any empty C++ object is an UnknownVal. Because RegionStore does not have binding extents, binding an empty object to an UnknownVal may potentially overwrite existing bindings at the same offset. Therefore, when performing a trivial copy of an empty object, don't try to take the value of the object and bind it to the copy. Doing nothing is accurate enough, and it doesn't screw any existing bindings. Differential Revision: https://reviews.llvm.org/D43714 llvm-svn: 326247
* [analyzer] Track temporaries without construction contexts for destruction.Artem Dergachev2018-02-271-11/+44
| | | | | | | | | | | | | | | | | | | | | | Sometimes it is not known at compile time which temporary objects will be constructed, eg. 'x ? A() : B()' or 'C() || D()'. In this case we track which temporary was constructed to know how to properly call the destructor. Once the construction context for temporaries was introduced, we moved the tracking code to the code that investigates the construction context. Bring back the old mechanism because construction contexts are not always available yet - eg. in the case where a temporary is constructed without a constructor expression, eg. returned from a function by value. The mechanism should still go away eventually. Additionally, fix a bug in the temporary cleanup code for the case when construction contexts are not available, which could lead to temporaries staying in the program state and increasing memory consumption. Differential Revision: https://reviews.llvm.org/D43666 llvm-svn: 326246
* [analyzer] Don't crash when dynamic type of a variable is set via placement new.Artem Dergachev2018-02-271-1/+9
| | | | | | | | | | | | | | | | | | | If a variable or an otherwise a concrete typed-value region is being placement-new'ed into, its dynamic type may change in arbitrary manners. And when the region is used, there may be a third type that's different from both the static and the dynamic type. It cannot be *completely* different from the dynamic type, but it may be a base class of the dynamic type - and in this case there isn't (and shouldn't be) any indication anywhere in the AST that there is a derived-to-base cast from the dynamic type to the third type. Perform a generic cast (evalCast()) from the third type to the dynamic type in this case. From the point of view of the SVal hierarchy, this would have produced non-canonical SVals if we used such generic cast in the normal case, but in this case there doesn't seem to be a better option. Differential Revision: https://reviews.llvm.org/D43659 llvm-svn: 326245
* [analyzer] Disable constructor inlining when lifetime extending through a field.Artem Dergachev2018-02-272-0/+17
| | | | | | | | | | | | | Automatic destructors are missing in the CFG in situations like const int &x = C().x; For now it's better to disable construction inlining, because inlining constructors while doing nothing on destructors is very bad. Differential Revision: https://reviews.llvm.org/D43689 llvm-svn: 326240
* [analyzer] Self-debug: Dump dynamic type info and taint with the program state.Artem Dergachev2018-02-272-1/+31
| | | | | | | | Useful for debugging problems with dynamic type info and taint. Differential Revision: https://reviews.llvm.org/D43657 llvm-svn: 326239
* [CFG] NFC: Refactor ConstructionContext into a finite set of cases.Artem Dergachev2018-02-272-57/+81
| | | | | | | | | | | | | | | | | | | | | ConstructionContext is moved into a separate translation unit and is separated into multiple classes. The "old" "raw" ConstructionContext is renamed into ConstructionContextLayer - which corresponds to the idea of building the context gradually layer-by-layer, but it isn't easy to use in the clients. Once CXXConstructExpr is reached, layers that we've gathered so far are transformed into the actual, "new-style" "flat" ConstructionContext, which is put into the CFGConstructor element and has no layers whatsoever (until it actually needs them, eg. aggregate initialization). The new-style ConstructionContext is instead presented as a variety of sub-classes that enumerate different ways of constructing an object in C++. There are 5 of these supported for now, which is around a half of what needs to be supported. The layer-by-layer buildup process is still a little bit weird, but it hides all the weirdness in one place, that sounds like a good thing. Differential Revision: https://reviews.llvm.org/D43533 llvm-svn: 326238
* [analyzer] Introduce correct lifetime extension behavior in simple cases.Artem Dergachev2018-02-272-41/+143
| | | | | | | | | | | | | | | | | | | | | | | | This patch uses the reference to MaterializeTemporaryExpr stored in the construction context since r326014 in order to model that expression correctly. When modeling MaterializeTemporaryExpr, instead of copying the raw memory contents from the sub-expression's rvalue to a completely new temporary region, that we conjure up for the lack of better options, we now have the better option to recall the region into which the object was originally constructed and declare that region to be the value of the expression, which is semantically correct. This only works when the construction context is available, which is worked on independently. The temporary region's liveness (in the sense of removeDeadBindings) is extended until the MaterializeTemporaryExpr is resolved, in order to keep the store bindings around, because it wouldn't be referenced from anywhere else in the program state. Differential Revision: https://reviews.llvm.org/D43497 llvm-svn: 326236
* [analyzer] Remove redundant checkGeorge Karpenkov2018-02-271-2/+0
| | | | | | | | There is no point in assigning void just to crash on it in the next line Differential Revision: https://reviews.llvm.org/D43802 llvm-svn: 326234
* [analyzer] Only attempt to get the value of locations of known typeGeorge Karpenkov2018-02-271-1/+1
| | | | | | | | | | | | Fixes https://bugs.llvm.org/show_bug.cgi?id=36474 In general, getSVal API should be changed so that it does not crash on some non-obvious conditions. It should either be updated to require a type, or to return Optional<SVal>. Differential Revision: https://reviews.llvm.org/D43801 llvm-svn: 326233
* [analyzer] Quickfix: don't crash when runtime definition is not available.George Karpenkov2018-02-271-3/+5
| | | | llvm-svn: 326230
* [analyzer] Switch the default exploration strategy to priority queue based ↵George Karpenkov2018-02-271-1/+1
| | | | | | | | | | on coverage After the investigation it seems safe to flip the switch. Differential Revision: https://reviews.llvm.org/D43782 llvm-svn: 326157
* Revert "Revert "[analyzer] Quickfix: do not overflow in calculating offset ↵George Karpenkov2018-02-271-0/+47
| | | | | | | | | | in RegionManager"" This reverts commit c4cc41166d93178a3ddd4b2b5a685cf74a459247. Revert and fix uninitialized read. llvm-svn: 326152
* [StaticAnalyzer] Fix some Clang-tidy modernize and Include What You Use ↵Eugene Zelenko2018-02-263-186/+199
| | | | | | warnings; other minor fixes (NFC). llvm-svn: 326146
OpenPOWER on IntegriCloud