summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Fix a couple of bugs in HTML report generation.Artem Dergachev2020-02-101-1/+10
| | | | | | | | It should now produce valid HTML again. Differential Revision: https://reviews.llvm.org/D73993 (cherry picked from commit 482e236e569e8324f70778af1eb756923cd490dc)
* [Concepts] Requires ExpressionsSaar Raz2020-01-241-0/+1
| | | | | | | | | | Implement support for C++2a requires-expressions. Re-commit after compilation failure on some platforms due to alignment issues with PointerIntPair. Differential Revision: https://reviews.llvm.org/D50360 (cherry picked from commit a0f50d731639350c7a79f140f026c27a18215531)
* [analyzer] Fix SARIF column locationsJoe Ranieri2020-01-141-21/+59
| | | | Differential revision: https://reviews.llvm.org/D70689
* Make helper functions static or move them into anonymous namespaces. NFC.Benjamin Kramer2020-01-142-1/+4
|
* Fix "pointer is null" static analyzer warnings. NFCI.Simon Pilgrim2020-01-121-8/+9
| | | | Use cast<> instead of dyn_cast<> and move into its users where its dereferenced immediately.
* [analyzer] Add PlacementNewCheckerGabor Marton2020-01-102-0/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This checker verifies if default placement new is provided with pointers to sufficient storage capacity. Noncompliant Code Example: #include <new> void f() { short s; long *lp = ::new (&s) long; } Based on SEI CERT rule MEM54-CPP https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM54-CPP.+Provide+placement+new+with+properly+aligned+pointe This patch does not implement checking of the alignment. Reviewers: NoQ, xazax.hun Subscribers: mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat Tags: #clang Differential Revision: https://reviews.llvm.org/D71612
* [NFC] Fixes -Wrange-loop-analysis warningsMark de Wever2020-01-011-1/+1
| | | | | | This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D71857
* [Analyzer] Fixes -Wrange-loop-analysis warningsMark de Wever2019-12-223-5/+6
| | | | | | This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D71809
* [Analyzer] Use a reference in a range-based forMark de Wever2019-12-213-15/+15
| | | | | | | | This avoids unneeded copies when using a range-based for loops. This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D70869
* [analyzer] Add path notes to FuchsiaHandleCheck.Gabor Horvath2019-12-201-3/+73
| | | | Differential Revision: https://reviews.llvm.org/D70725
* [analyzer] Add Fuchsia Handle checkerGabor Horvath2019-12-202-0/+487
| | | | | | | The checker can diagnose handle use after releases, double releases, and handle leaks. Differential Revision: https://reviews.llvm.org/D70470
* [analyzer] Add a syntactic security check for ObjC NSCoder API.Artem Dergachev2019-12-191-0/+68
| | | | | | | Method '-[NSCoder decodeValueOfObjCType:at:]' is not only deprecated but also a security hazard, hence a loud check. Differential Revision: https://reviews.llvm.org/D71728
* [analysis] Re-discard type sugar when casting values retrieved from the Store.Artem Dergachev2019-12-181-3/+3
| | | | Canonicalization was accidentally omitted in 6d3f43ec.
* [analyzer] Teach MismatchedDealloc about initWithBytesNoCopy with deallocator.Artem Dergachev2019-12-181-0/+3
| | | | | | | | MallocChecker warns when memory is passed into -[NSData initWithBytesNoCopy] but isn't allocated by malloc(), because it will be deallocated by free(). However, initWithBytesNoCopy has an overload that takes an arbitrary block for deallocating the object. If such overload is used, it is no longer necessary to make sure that the memory is allocated by malloc().
* [analyzer] NonnullGlobalConstants: Add support for kCFNull.Artem Dergachev2019-12-181-1/+3
| | | | It's a singleton in CoreFoundation that always contains a non-null CFNullRef.
* [CFG] Add an option to expand CXXDefaultInitExpr into aggregate initializationGabor Horvath2019-12-171-0/+2
| | | | | | | | | | This is useful for clients that are relying on linearized CFGs for evaluating subexpressions and want the default initializer to be evaluated properly. The upcoming lifetime analysis is using this but it might also be useful for the static analyzer at some point. Differential Revision: https://reviews.llvm.org/D71642
* [analysis] Discard type qualifiers when casting values retrieved from the Store.Artem Dergachev2019-12-171-4/+10
| | | | | | | | | This canonicalizes the representation of unknown pointer symbols, which reduces the overall confusion in pointer cast representation. Patch by Vince Bridgers! Differential Revision: https://reviews.llvm.org/D70836
* [analyzer] Add support for namespaces to GenericTaintCheckerBorsik Gabor2019-12-151-58/+123
| | | | | | | | | | | | | This patch introduces the namespaces for the configured functions and also enables the use of the member functions. I added an optional Scope field for every configured function. Functions without Scope match for every function regardless of the namespace. Functions with Scope will match if the full name of the function starts with the Scope. Multiple functions can exist with the same name. Differential Revision: https://reviews.llvm.org/D70878
* Move ASTRecordReader into its own header; NFC.John McCall2019-12-141-0/+1
| | | | | | | | | | | | | AbstractBasicReader.h has quite a few dependencies already, and that's only likely to increase. Meanwhile, ASTRecordReader is really an implementation detail of the ASTReader that is only used in a small number of places. I've kept it in a public header for the use of projects like Swift that might want to plug in to Clang's serialization framework. I've also moved OMPClauseReader into an implementation file, although it can't be made private because of friendship.
* [analyzer] CStringChecker: Fix a crash on unknown value passed to strlcat.Artem Dergachev2019-12-131-6/+5
| | | | | | Checkers should always account for unknown values. Also use a slightly more high-level API that naturally avoids the problem.
* [analyzer] Do not cache out on some shared implicit AST nodesGabor Horvath2019-12-112-1/+6
| | | | | | | | | | | Some AST nodes which stands for implicit initialization is shared. The analyzer will do the same evaluation on the same nodes resulting in the same state. The analyzer will "cache out", i.e. it thinks that it visited an already existing node in the exploded graph. This is not true in this case and we lose coverage. Since these nodes do not really require any processing from the analyzer we just omit them from the CFG. Differential Revision: https://reviews.llvm.org/D71371
* [analyzer] Escape symbols conjured into specific regions during a ↵Gabor Horvath2019-12-114-39/+109
| | | | | | | | | | conservative EvalCall This patch introduced additional PointerEscape callbacks after conservative calls for output parameters. This should not really affect the current checkers but the upcoming FuchsiaHandleChecker relies on this heavily. Differential Revision: https://reviews.llvm.org/D71224
* [analyzer] LocalizationChecker: Fix a crash on synthesized accessor stubs.Artem Dergachev2019-12-111-1/+4
| | | | | | The checker was trying to analyze the body of every method in Objective-C @implementation clause but the sythesized accessor stubs that were introduced into it by 2073dd2d have no bodies.
* [analyzer] CStringChecker: Fix overly eager assumption that memcmp args overlap.Artem Dergachev2019-12-111-14/+13
| | | | | | | | | | | | | | | | | While analyzing code `memcmp(a, NULL, n);', where `a' has an unconstrained symbolic value, the analyzer was emitting a warning about the *first* argument being a null pointer, even though we'd rather have it warn about the *second* argument. This happens because CStringChecker first checks whether the two argument buffers are in fact the same buffer, in order to take the fast path. This boils down to assuming `a == NULL' to true. Then the subsequent check for null pointer argument "discovers" that `a' is null. Don't take the fast path unless we are *sure* that the buffers are the same. Otherwise proceed as normal. Differential Revision: https://reviews.llvm.org/D71322
* [analyzer] CStringChecker: Improve warning messages.Artem Dergachev2019-12-111-4/+7
| | | | Differential Revision: https://reviews.llvm.org/D71321
* [Analyzer] Iterator Checkers: Replace `UnknownVal` in comparison result by a ↵Adam Balogh2019-12-111-5/+15
| | | | | | | | | | | | | conjured value Sometimes the return value of a comparison operator call is `UnkownVal`. Since no assumptions can be made on `UnknownVal`, this leeds to keeping impossible execution paths in the exploded graph resulting in poor performance and false positives. To overcome this we replace unknown results of iterator comparisons by conjured symbols. Differential Revision: https://reviews.llvm.org/D70244
* [Analyzer] Iterator Modeling: Print Container Data and Iterator Positions ↵Adam Balogh2019-12-111-0/+55
| | | | | | | | | | | | when printing the Program State Debugging the Iterator Modeling checker or any of the iterator checkers is difficult without being able to see the relations between the iterator variables and their abstract positions, as well as the abstract symbols denoting the begin and the end of the container. This patch adds the checker-specific part of the Program State printing to the Iterator Modeling checker.
* [Analyzer][NFC] Iterator Checkers - Separate iterator modeling and the ↵Adam Balogh2019-12-118-1131/+1429
| | | | | | | | | | actual checkers A monolithic checker class is hard to maintain. This patch splits it up into a modeling part, the three checkers and a debug checker. The common functions are moved into a library. Differential Revision: https://reviews.llvm.org/D70320
* Revert "[analyzer] Keep track of escaped locals"Gabor Horvath2019-12-102-25/+3
| | | | | | | | | | | | | | | It was a step in the right direction but it is not clear how can this fit into the checker API at this point. The pre-escape happens in the analyzer core and the checker has no control over it. If the checker is not interestd in a pre-escape it would need to do additional work on each escape to check if the escaped symbol is originated from an "uninteresting" pre-escaped memory region. In order to keep the checker API simple we abandoned this solution for now. We will reland this once we have a better answer for what to do on the checker side. This reverts commit f3a28202ef58551db15818f8f51afd21e0f3e231.
* [analyzer] Keep track of escaped localsGabor Horvath2019-12-102-3/+25
| | | | | | | | We want to escape all symbols that are stored into escaped regions. The problem is, we did not know which local regions were escaped. Until now. This should fix some false positives like the one in the tests. Differential Revision: https://reviews.llvm.org/D71152
* Remove Expr.h include from ASTContext.h, NFCReid Kleckner2019-12-065-5/+10
| | | | | | | ASTContext.h is popular, prune its includes. Expr.h brings in Attr.h, which is also expensive. Move BlockVarCopyInit to Expr.h to accomplish this.
* [ObjC] Make sure that the implicit arguments for direct methods have been setupAlex Lorenz2019-12-061-7/+0
| | | | | | | | | | | | | | | | | | | | This commit sets the Self and Imp declarations for ObjC method declarations, in addition to the definitions. It also fixes a bunch of code in clang that had wrong assumptions about when getSelfDecl() would be set: - CGDebugInfo::getObjCMethodName and AnalysisConsumer::getFunctionName would assume that it was set for method declarations part of a protocol, which they never were, and that self would be a Class type, which it isn't as it is id for a protocol. Also use the Canonical Decl to index the set of Direct methods so that when calls and implementations interleave, the same llvm::Function is used and the same symbol name emitted. Radar-Id: rdar://problem/57661767 Patch by: Pierre Habouzit Differential Revision: https://reviews.llvm.org/D71091
* [analyzer] Fix false positive on introspection of a block's internal layout.Artem Dergachev2019-12-061-1/+2
| | | | | | When implementation of the block runtime is available, we should not warn that block layout fields are uninitialized simply because they're on the stack.
* Add `QualType::hasAddressSpace`. NFC.Michael Liao2019-12-061-1/+1
| | | | | - Add that as a shorthand of <T>.getQualifiers().hasAddressSpace(). - Simplify related code.
* [OpenMP50] Add parallel master constructcchen2019-12-051-0/+1
| | | | | | | | | | | | Reviewers: ABataev, jdoerfert Reviewed By: ABataev Subscribers: rnk, jholewinski, guansong, arphaman, jfb, cfe-commits, sandoval, dreachem Tags: #clang Differential Revision: https://reviews.llvm.org/D70726
* [Checkers] Added support for freopen to StreamChecker.Balázs Kéri2019-12-051-0/+45
| | | | | | | | | | | | | | Summary: Extend StreamChecker with a new evaluation function for API call 'freopen'. Reviewers: NoQ, baloghadamsoftware, Szelethus, martong Reviewed By: baloghadamsoftware, martong Subscribers: martong, rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69948
* Revert "[OpenMP50] Add parallel master construct, by Chi Chun Chen."Reid Kleckner2019-12-041-1/+0
| | | | | | This reverts commit 713dab21e27c987b9114547ce7136bac2e775de9. Tests do not pass on Windows.
* [OpenMP50] Add parallel master construct, by Chi Chun Chen.cchen2019-12-041-0/+1
| | | | | | | | | | | | Reviewers: ABataev, jdoerfert Reviewed By: ABataev Subscribers: jholewinski, guansong, arphaman, jfb, cfe-commits, sandoval, dreachem Tags: #clang Differential Revision: https://reviews.llvm.org/D70726
* [NFCI] update formating for misleading indentation warningTyker2019-12-031-11/+10
| | | | | | | | Reviewers: xbolva00 Reviewed By: xbolva00 Differential Revision: https://reviews.llvm.org/D70861
* [analyzer] Add custom filter functions for GenericTaintCheckerBorsik Gabor2019-11-233-56/+112
| | | | | | | | | | | This patch is the last of the series of patches which allow the user to annotate their functions with taint propagation rules. I implemented the use of the configured filtering functions. These functions can remove taintedness from the symbols which are passed at the specified arguments to the filters. Differential Revision: https://reviews.llvm.org/D59516
* [analyzer] Fix Objective-C accessor body farms after 2073dd2d.Artem Dergachev2019-11-211-0/+2
| | | | | | | | | | Fix a canonicalization problem for the newly added property accessor stubs that was causing a wrong decl to be used for 'self' in the accessor's body farm. Fix a crash when constructing a body farm for accessors of a property that is declared and @synthesize'd in different (but related) interfaces. Differential Revision: https://reviews.llvm.org/D70158
* [analyzer] NFC: Don't clean up range constraints twice.Artem Dergachev2019-11-212-7/+6
| | | | | | Slightly improves static analysis speed. Differential Revision: https://reviews.llvm.org/D70150
* [NFC] Refactor representation of materialized temporariesTyker2019-11-193-4/+3
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: thakis, sammccall, ilya-biryukov, rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* Revert "[NFC] Refactor representation of materialized temporaries"Nico Weber2019-11-173-3/+4
| | | | | | This reverts commit 08ea1ee2db5f9d6460fef1d79d0d1d1a5eb78982. It broke ./ClangdTests/FindExplicitReferencesTest.All on the bots, see comments on https://reviews.llvm.org/D69360
* [NFC] Refactor representation of materialized temporariesTyker2019-11-163-4/+3
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* Remove +x permission on some filesSylvestre Ledru2019-11-161-0/+0
|
* [Analyzer] Use a reference in a range-based forMark de Wever2019-11-121-11/+11
| | | | | | | | | Let the checkers use a reference instead of a copy in a range-based for loop. This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D70047
* [analyzer] Fix skipping the call during inlined defensive check suppression.Artem Dergachev2019-11-081-11/+12
| | | | | | | | | | | | | | | | | | | | | When bugreporter::trackExpressionValue() is invoked on a DeclRefExpr, it tries to do most of its computations over the node in which this DeclRefExpr is computed, rather than on the error node (or whatever node is stuffed into it). One reason why we can't simply use the error node is that the binding to that variable might have already disappeared from the state by the time the bug is found. In case of the inlined defensive checks visitor, the DeclRefExpr node is in fact sometimes too *early*: the call in which the inlined defensive check has happened might have not been entered yet. Change the visitor to be fine with tracking dead symbols (which it is totally capable of - the collapse point for the symbol is still well-defined), and fire it up directly on the error node. Keep using "LVState" to find out which value should we be tracking, so that there weren't any problems with accidentally loading an ill-formed value from a dead variable. Differential Revision: https://reviews.llvm.org/D67932
* [analyzer] Nullability: Don't infer nullable when passing as nullable parameter.Artem Dergachev2019-11-081-5/+0
| | | | You can't really infer anything from that.
* Redeclare Objective-C property accessors inside the ObjCImplDecl in which ↵Adrian Prantl2019-11-082-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | they are synthesized. This patch is motivated by (and factored out from) https://reviews.llvm.org/D66121 which is a debug info bugfix. Starting with DWARF 5 all Objective-C methods are nested inside their containing type, and that patch implements this for synthesized Objective-C properties. 1. SemaObjCProperty populates a list of synthesized accessors that may need to inserted into an ObjCImplDecl. 2. SemaDeclObjC::ActOnEnd inserts forward-declarations for all accessors for which no override was provided into their ObjCImplDecl. This patch does *not* synthesize AST function *bodies*. Moving that code from the static analyzer into Sema may be a good idea though. 3. Places that expect all methods to have bodies have been updated. I did not update the static analyzer's inliner for synthesized properties to point back to the property declaration (see test/Analysis/Inputs/expected-plists/nullability-notes.m.plist), which I believed to be more bug than a feature. Differential Revision: https://reviews.llvm.org/D68108 rdar://problem/53782400
OpenPOWER on IntegriCloud