summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis/inlining
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Look through OpaqueValueExprs when tracking a nil value.Jordan Rose2012-09-221-0/+469
| | | | | | | This allows us to show /why/ a particular object is nil, even when it is wrapped in an OpaqueValueExpr. llvm-svn: 164445
* [analyzer] Re-add reinterpret_cast virtual call test case from r163644.Jordan Rose2012-09-121-0/+16
| | | | | | | We mostly just don't want to crash analyzing this test case; it's likely the code found here will actually crash if compiled and run. llvm-svn: 163746
* Revert "[analyzer] Use the static type for a virtual call if the dynamic ↵Jordan Rose2012-09-121-16/+0
| | | | | | | | | | | | type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. llvm-svn: 163744
* Adjust some analyzer tests to place widely shared inputs inside of anChandler Carruth2012-09-121-1/+1
| | | | | | | | | | | | | | | 'Inputs' subdirectory. The general desire has been to have essentially all of the non-test input files live in such directories, with some exceptions for obvious and common patterns like 'foo.c' using 'foo.h'. This came up because our distributed test runner couldn't find some of the headers, for example with stl.cpp. No functionality changed, just shuffling around here. llvm-svn: 163674
* [analyzer] Use the static type for a virtual call if the dynamic type is worse.Jordan Rose2012-09-111-0/+16
| | | | | | | | | | | | | reinterpret_cast does not provide any of the usual type information that static_cast or dynamic_cast provide -- only the new type. This can get us in a situation where the dynamic type info for an object is actually a superclass of the static type, which does not match what CodeGen does at all. In these cases, just fall back to the static type as the best possible type for devirtualization. Should fix the crashes on our internal buildbot. llvm-svn: 163644
* [analyzer] Turn stl inlining back on.Anna Zaks2012-09-101-1/+1
| | | | | | | The one reported bug, which was exposed by stl inlining, is addressed in r163558. llvm-svn: 163574
* [analyzer] Do not count calls to small functions when computing stackAnna Zaks2012-09-101-0/+18
| | | | | | | | | depth. We only want to count how many substantial functions we inlined. This is an improvement to r163558. llvm-svn: 163571
* [analyzer] Add an option to enable/disable objc inlining.Anna Zaks2012-09-101-0/+33
| | | | llvm-svn: 163562
* [analyzer] Add ipa-always-inline-size option (with 3 as the default).Anna Zaks2012-09-101-0/+30
| | | | | | | | The option allows to always inline very small functions, whose size (in number of basic blocks) is set using -analyzer-config ipa-always-inline-size option. llvm-svn: 163558
* [analyzer] For now, don't inline C++ standard library functions.Jordan Rose2012-09-101-0/+29
| | | | | | | | | | | | | | | | This is a (heavy-handed) solution to PR13724 -- until we know we can do a good job inlining the STL, it's best to be consistent and not generate more false positives than we did before. We can selectively whitelist certain parts of the 'std' namespace that are known to be safe. This is controlled by analyzer config option 'c++-stdlib-inlining', which can be set to "true" or "false". This commit also adds control for whether or not to inline any templated functions (member or non-member), under the config option 'c++-template-inlining'. This option is currently on by default. llvm-svn: 163548
* Attempt (again) to stabilize the order of the emission of diagnosticsTed Kremenek2012-09-081-2743/+2734
| | | | | | | of the analyzer by using the FullProfile() of a PathDiagnostic for ordering them. llvm-svn: 163455
* [analyzer] Fixup for r162935 as per Jordan's review.Anna Zaks2012-08-301-1/+1
| | | | | | Thanks for catching this! llvm-svn: 162949
* [analyzer] Do not propagate the [super init] could be nil assumptionAnna Zaks2012-08-301-0/+41
| | | | | | | | from callee to caller. radar://12109638 llvm-svn: 162935
* [analyzer] Stop tracking symbols based on a retain count summary ofAnna Zaks2012-08-291-0/+62
| | | | | | | | | | | | inlined function. This resolves retain count checker false positives that are caused by inlining ObjC and other methods. Essentially, if we are passing an object to a method with "delegate" in the selector or a function pointer as another argument, we should stop tracking the other parameters/return value as far as the retain count checker is concerned. llvm-svn: 162876
* [analyzer] If the last store into a region came from a function, step into it.Jordan Rose2012-08-281-35/+433
| | | | | | | | | | | | | Previously, if we were tracking stores to a variable 'x', and came across this: x = foo(); ...we would simply emit a note here and stop. Now, we'll step into 'foo' and continue tracking the returned value from there. <rdar://problem/12114689> llvm-svn: 162718
* [analyzer] Look through casts when trying to track a null pointer dereference.Jordan Rose2012-08-271-48/+401
| | | | | | | | Also, add comments to addTrackNullOrUndefValueVisitor. Thanks for the review, Anna! llvm-svn: 162695
* [analyzer] If we dereference a NULL that came from a function, show the return.Jordan Rose2012-08-241-0/+800
| | | | | | | | | | | | More generally, any time we try to track where a null value came from, we should show if it came from a function. This usually isn't necessary if the value is symbolic, but if the value is just a constant we previously just ignored its origin entirely. Now, we'll step into the function and recursively add a visitor to the returned expression. <rdar://problem/12114609> llvm-svn: 162563
* [analyzer] Make analyzer less aggressive when dealing with [self init].Anna Zaks2012-08-242-1/+101
| | | | | | | | | | | | | | With inlining, retain count checker starts tracking 'self' through the init methods. The analyser results were too noisy if the developer did not follow 'self = [super init]' pattern (which is common especially in older code bases) - we reported self init anti-pattern AND possible use-after-free. This patch teaches the retain count checker to assume that [super init] does not fail when it's not consumed by another expression. This silences the retain count warning that warns about possibility of use-after-free when init fails, while preserving all the other checking on 'self'. llvm-svn: 162508
* [analyzer] -analyzer-ipa=inlining is now the default. Remove it from tests.Jordan Rose2012-08-211-2/+2
| | | | | | | | | | | | | The actual change here is a little more complicated than the summary above. What we want to do is have our generic inlining tests run under whatever mode is the default. However, there are some tests that depend on the presence of C++ inlining, which still has some rough edges. These tests have been explicitly marked as -analyzer-ipa=inlining in preparation for a new mode that limits inlining to C functions and blocks. This will be the default until the false positives for C++ have been brought down to manageable levels. llvm-svn: 162317
* [analyzer] Don't inline dynamic-dispatch methods unless -analyzer-ipa=dynamic.Jordan Rose2012-08-151-0/+17
| | | | | | | | Previously we were checking -analyzer-ipa=dynamic-bifurcate only, and unconditionally inlining everything else that had an available definition, even under -analyzer-ipa=inlining (but not under -analyzer-ipa=none). llvm-svn: 161916
* [analyzer]Assume that the properties cannot be overridden when dotAnna Zaks2012-08-141-4/+4
| | | | | | syntax is used. llvm-svn: 161889
* [analyzer] Address Jordan's comments for r161822, r161683.Anna Zaks2012-08-142-1/+31
| | | | | | | | | | Add a TODO test case for r161822 - calling self from a class method. Remove a TODO comment for r161683 - value2 is not a property - we just have method names that look like they are getters/setters for a property. llvm-svn: 161884
* [analyzer] Teach live variable analyzes that super uses self pointer.Anna Zaks2012-08-141-0/+33
| | | | llvm-svn: 161822
* [analyzer] ObjC Inlining: add tests for ivars and properties.Anna Zaks2012-08-102-2/+91
| | | | | | | | | | TODO: - Handle @syncronized properties. - Always inline properties declared publicly (do not split the path). This is tricky since there is no mapping from a Decl to the property in the AST as far as I can tell. llvm-svn: 161683
* [analyzer] Track if a region can be a subclass in the dynamic type info.Anna Zaks2012-08-105-40/+27
| | | | | | | When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
* [analyzer] Optimize dynamic dispatch bifurcation by detecting the casesAnna Zaks2012-08-102-23/+81
| | | | | | | | | | | | | | | | when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
* [analyzer] Bifurcate the path with dynamic dispatch.Anna Zaks2012-08-091-0/+51
| | | | | | | | | | | | | This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
* [analyzer] + New line at end of fileAnna Zaks2012-08-071-1/+1
| | | | llvm-svn: 161392
* [analyzer] Address Jordan's review of DynamicTypePropagation.Anna Zaks2012-08-071-2/+16
| | | | llvm-svn: 161391
* [analyzer] DynTypes: Add a test for improper cast performed by user.Anna Zaks2012-08-061-0/+37
| | | | | | | Dynamic type inference does the right thing in this case. However, as Jordan suggested, it would be nice to add a warning here as well. llvm-svn: 161365
* [analyzer] Dynamic type info - propagate through implicit casts.Anna Zaks2012-08-061-4/+22
| | | | | | | | I currently have a bit of redundancy with the cast kind switch statement inside the ImplicitCast callback, but I might be adding more casts going forward. llvm-svn: 161358
* [analyzer] Add a checker to manage dynamic type propagation.Anna Zaks2012-08-062-1/+76
| | | | | | | | | | | | Instead of sprinkling dynamic type info propagation throughout ExprEngine, the added checker would add the more precise type information on known APIs (Ex: ObjC alloc, new) and propagate the type info in other cases (ex: ObjC init method, casts (the second is not implemented yet)). Add handling of ObjC alloc, new and init to the checker. llvm-svn: 161357
* [analyzer] Add plist output checks for all four "path notes" tests.Jordan Rose2012-08-061-0/+1235
| | | | | | | | | No functionality change, but from now on, any new path notes should be tested both with plain-text output (for ease of human auditing) and with plist output (to ensure control flow and events are being correctly represented in Xcode). llvm-svn: 161351
* [analyzer] When a symbol is null, we should track its constraints.Jordan Rose2012-08-031-1/+43
| | | | | | | | Because of this, we would previously emit NO path notes when a parameter is constrained to null (because there are no stores). Now we show where we made the assumption, which is much more useful. llvm-svn: 161280
* [analyzer] Flatten path diagnostics for text output like we do for HTML.Jordan Rose2012-08-031-0/+14
| | | | llvm-svn: 161279
* [analyzer] ObjC Inlining: Start tracking dynamic type info in the GDMAnna Zaks2012-08-031-2/+2
| | | | | | | | | | | In the following code, find the type of the symbolic receiver by following it and updating the dynamic type info in the state when we cast the symbol from id to MyClass *. MyClass *a = [[self alloc] init]; return 5/[a testSelf]; llvm-svn: 161264
* [analyzer] Don't try to inline if there's no region for a message receiver.Jordan Rose2012-07-311-1/+7
| | | | | | | | While usually we'd use a symbolic region rather than a straight-up Unknown, we can still generate unknowns via array subscripts with symbolic indexes. (And if this ever changes in the future, we still shouldn't crash.) llvm-svn: 161059
* [analyzer] Very simple ObjC instance method inliningAnna Zaks2012-07-302-0/+99
| | | | | | | | | - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
* [analyzer] Add -analyzer-ipa=dynamic option for inlining dynamicallyAnna Zaks2012-07-301-1/+21
| | | | | | | | dispatched methods. Disabled by default for now. llvm-svn: 160988
* [analyzer] Another false positive in Class method inlining.Anna Zaks2012-07-271-0/+27
| | | | | | | We are currently not setting the self object to the calling class object during inlining nor do we reason about [AAA class]. llvm-svn: 160884
* [analyzer] Address Jordan's and Fariborz's review of r160768.Anna Zaks2012-07-271-0/+1
| | | | llvm-svn: 160883
* [analyzer] Inline ObjC class methods.Anna Zaks2012-07-261-0/+133
- Some cleanup(the TODOs) will be done after ObjC method inlining is complete. - Simplified CallEvent::getDefinition not to require ISDynamicDispatch parameter. - Also addressed Jordan's comments from r160530. llvm-svn: 160768
OpenPOWER on IntegriCloud