summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis/plist-output-alternate.m
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Bug identificationGabor Horvath2015-10-221-7/+21
| | | | | | | | | | | | | | | | This patch adds hashes to the plist and html output to be able to identfy bugs for suppressing false positives or diff results against a baseline. This hash aims to be resilient for code evolution and is usable to identify bugs in two different snapshots of the same software. One missing piece however is a permanent unique identifier of the checker that produces the warning. Once that issue is resolved, the hashes generated are going to change. Until that point this feature is marked experimental, but it is suitable for early adoption. Differential Revision: http://reviews.llvm.org/D10305 Original patch by: Bence Babati! llvm-svn: 251011
* [Static Analyzer] The name of the checker that reports a bug is addedGabor Horvath2015-02-091-0/+7
| | | | | | | | | | | to the plist output. This check_name field does not guaranteed to be the same as the name of the checker in the future. Reviewer: Anna Zaks Differential Revision: http://reviews.llvm.org/D6841 llvm-svn: 228624
* [analyzer] Enable the new edge algorithm by default.Jordan Rose2013-06-031-1/+1
| | | | | | | | | ...but don't yet migrate over the existing plist tests. Some of these would be trivial to migrate; others could use a bit of inspection first. In any case, though, the new edge algorithm seems to have proven itself, and we'd like more coverage (and more usage) of it going forwards. llvm-svn: 183165
* CFG: In a DeclStmt, skip anything that's not a VarDecl.Jordan Rose2013-06-031-4/+4
| | | | | | | | | | | | | Neither the compiler nor the analyzer are doing anything with non-VarDecl decls in the CFG, and having them there creates extra nodes in the analyzer's path diagnostics. Simplify the CFG (and the path edges) by simply leaving them out. We can always add interesting decls back in when they become relevant. Note that this only affects decls declared in a DeclStmt, and then only those that appear within a function body. llvm-svn: 183157
* [analyzer] Set the allocation site to be the uniqueing location for retain ↵Anna Zaks2013-04-231-1/+1
| | | | | | | | | | count checker leaks. The uniqueing location is the location which is part of the hash used to determine if two reports are the same. This is used by the CmpRuns.py script to compare two analyzer runs and determine which warnings are new. llvm-svn: 180166
* [analyzer] Refactor BugReport::getLocation and ↵Anna Zaks2013-04-231-22/+56
| | | | | | | | | | | | | | | PathDiagnosticLocation::createEndOfPath for greater code reuse The 2 functions were computing the same location using different logic (each one had edge case bugs that the other one did not). Refactor them to rely on the same logic. The location of the warning reported in text/command line output format will now match that of the plist file. There is one change in the plist output as well. When reporting an error on a BinaryOperator, we use the location of the operator instead of the beginning of the BinaryOperator expression. This matches our output on command line and looks better in most cases. llvm-svn: 180165
* [analyzer] Use 'MemRegion::printPretty()' instead of assuming the region is ↵Ted Kremenek2013-02-261-6/+6
| | | | | | | | | | | | a VarRegion. Fixes PR15358 and <rdar://problem/13295437>. Along the way, shorten path diagnostics that say "Variable 'x'" to just be "'x'". By the context, it is obvious that we have a variable, and so this just consumes text space. llvm-svn: 176115
* [analyzer] tracking stores/constraints now works for ObjC ivars or struct ↵Ted Kremenek2013-02-241-0/+63
| | | | | | | | | | | | | | | | | | | | | | | fields. This required more changes than I originally expected: - ObjCIvarRegion implements "canPrintPretty" et al - DereferenceChecker indicates the null pointer source is an ivar - bugreporter::trackNullOrUndefValue() uses an alternate algorithm to compute the location region to track by scouring the ExplodedGraph. This allows us to get the actual MemRegion for variables, ivars, fields, etc. We only hand construct a VarRegion for C++ references. - ExplodedGraph no longer drops nodes for expressions that are marked 'lvalue'. This is to facilitate the logic in the previous bullet. This may lead to a slight increase in size in the ExplodedGraph, which I have not measured, but it is likely not to be a big deal. I have validated each of the changed plist output. Fixes <rdar://problem/12114812> llvm-svn: 175988
* [analyzer] Plist: change the type of issue_hash from int to string.Anna Zaks2013-01-081-7/+7
| | | | | | This gives more flexibility to what could be stored as issue_hash. llvm-svn: 171824
* [analyzer] Report leaks at the closing brace of a function body.Jordan Rose2012-11-151-58/+9
| | | | | | | | | | | | | | | | | | | | This fixes a few cases where we'd emit path notes like this: +---+ 1| v p = malloc(len); ^ |2 +---+ In general this should make path notes more consistent and more correct, especially in cases where the leak happens on the false branch of an if that jumps directly to the end of the function. There are a couple places where the leak is reported farther away from the cause; these are usually cases where there are several levels of nested braces before the end of the function. This still matches our current behavior for when there /is/ a statement after all the braces, though. llvm-svn: 168070
* [analyzer] Mark symbol values as dead in the environment.Jordan Rose2012-11-151-9/+58
| | | | | | | | | | | | | | This allows us to properly remove dead bindings at the end of the top-level stack frame, using the ReturnStmt, if there is one, to keep the return value live. This in turn removes the need for a check::EndPath callback in leak checkers. This does cause some changes in the path notes for leak checkers. Previously, a leak would be reported at the location of the closing brace in a function. Now, it gets reported at the last statement. This matches the way leaks are currently reported for inlined functions, but is less than ideal for both. llvm-svn: 168066
* TrackConstraintBRVisitor and ConditionBRVisitor can emit similarTed Kremenek2012-10-251-58/+0
| | | | | | | | | | | | path notes for cases where a value may be assumed to be null, etc. Instead of having redundant diagnostics, do a pass over the generated PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor that are already covered by ConditionBRVisitor, whose notes tend to be better. Fixes <rdar://problem/12252783> llvm-svn: 166728
* [analyzer] Track a null value back through FindLastStoreBRVisitor.Jordan Rose2012-09-221-16/+108
| | | | | | | Also, tidy up the other tracking visitors so that they mark the right things as interesting and don't do extra work. llvm-svn: 164448
* Fix bug in BugReporter::RemoveUneededCalls() where "prunable"Ted Kremenek2012-09-081-1/+58
| | | | | | | PathDiagnosticEventPieces were *always* pruned. Instead, they are suppose to only be pruned if the entire call gets pruned. llvm-svn: 163460
* Attempt (again) to stabilize the order of the emission of diagnosticsTed Kremenek2012-09-081-919/+1125
| | | | | | | of the analyzer by using the FullProfile() of a PathDiagnostic for ordering them. llvm-svn: 163455
* Fix analyzer tests.Ted Kremenek2012-08-241-1/+1
| | | | llvm-svn: 162588
* [analyzer] Add experimental "issue hash" to the plist diagnostic.Anna Zaks2012-06-081-0/+7
| | | | | | | | | | | | | | CmpRuns.py can be used to compare issues from different analyzer runs. Since it uses the issue line number to unique 2 issues, adding a new line to the beginning of a file makes all issues in the file reported as new. The hash will be an opaque value which could be used (along with the function name) by CmpRuns to identify the same issues. This way, we only fail to identify the same issue from two runs if the function it appears in changes (not perfect, but much better than nothing). llvm-svn: 158180
* PlistDiagnostics: force the ranges for control-flow edges to be single ↵Ted Kremenek2012-06-051-21/+21
| | | | | | | | locations, forcing adjacent edges to have compatible ranges. This simplifies the layout logic for some clients. llvm-svn: 158028
* Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that ↵Ted Kremenek2012-04-061-6/+6
| | | | | | | | | | | | | | | | | | when we generate a new ExplodedNode we use the same Expr* as the one being currently visited. This is preparation for transitioning to having ProgramPoints refer to CFGStmts. This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact, as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but it will look a lot cleaner when were start using CFGStmt* in the appropriate places. As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed. I have audited these, and they look reasonable. llvm-svn: 154214
* Include the "issue context" (e.g. function or method) where a static ↵Ted Kremenek2012-04-041-0/+23
| | | | | | | | analyzer issue occurred in the plist output. Fixes <rdar://problem/11004527> llvm-svn: 154030
* [analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek2012-03-091-154/+98
| | | | | | | | | | | | | | | | | symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. llvm-svn: 152361
* [analyzer] Retain release: drop the line number info from the leakAnna Zaks2012-02-281-1/+1
| | | | | | message. llvm-svn: 151657
* [analyzer] Fix a bug in RetainReleaseChecker diagnostics. It gives more ↵Anna Zaks2011-09-301-1/+1
| | | | | | precise error message on the modified test case (and prevents duplicate diagnostics when we purge at block granularity). llvm-svn: 140840
* [analyzer] Refactor: make PathDiagnosticLocation responsible for validation ↵Anna Zaks2011-09-161-1/+1
| | | | | | | | | | of SourceLocations (commit 5 of ?): - Get rid of PathDiagnosticLocation(SourceRange r,..) constructor by providing a bunch of create methods. - The PathDiagnosticLocation(SourceLocation L,..), which is used by crate methods, will eventually become private. - Test difference is in the case when the report starts at the beginning of the function. We used to represent that point as a range of the very first token in the first statement. Now, it's just a single location representing the first character of the first statement. llvm-svn: 139932
* [analyzer] Refactor: make PathDiagnosticLocation responsible for validation ↵Anna Zaks2011-09-151-15/+0
| | | | | | | | | of SourceLocations (commit 4 of ?): - The closing brace is always a single location, not a range. - The test case previously had a location key 57:1 followed by a range [57:1 - 57:1]. llvm-svn: 139832
* [analyzer] After CFG has been linearized, we can have a situation where an ↵Anna Zaks2011-09-141-1/+186
| | | | | | | | | | ExpoledNode has an invalid SourceLocation (which has no correspondence in the source code). This commit is the first step to solve this problem. - It adds LocationContext to the PathDiagnosticLocation object and uses it to lookup the enclosing statement with a valid location. - So far, the LocationContext is only available when the object is constructed from the ExplodedNode. - Already found some subtle bugs(in plist-output-alternate.m) where the intermediate diagnostic steps were not previously shown. llvm-svn: 139703
* [analyzer] Move the knowledge of whether or not GC is enabled for the ↵Jordy Rose2011-09-021-1/+1
| | | | | | | | | | current analysis from CFRefCount to ExprEngine. Remove TransferFuncs from ExprEngine and AnalysisConsumer. Demote RetainReleaseChecker to a regular checker, and give it the name osx.cocoa.RetainCount (class name change coming shortly). Update tests accordingly. llvm-svn: 138998
* [analyzer] rename all experimental checker packages to have 'experimental' ↵Ted Kremenek2011-08-031-1/+1
| | | | | | be the common root package. llvm-svn: 136835
* [analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to ↵Ted Kremenek2011-07-281-187/+7
| | | | | | | | | | | | be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs. The motivation of this large change is to drastically simplify the logic in ExprEngine going forward. Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will need to be fixed over time. There is also some possible performance regression as RemoveDeadBindings will be called frequently; this can also be improved over time. llvm-svn: 136419
* Tighen analyzer diagnostics w.r.t ObjC/CF leaks.Ted Kremenek2011-05-261-4/+5
| | | | llvm-svn: 132130
* [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best ↵Argyrios Kyrtzidis2011-02-281-1/+1
| | | | | | misnomer award. llvm-svn: 126676
* [analyzer] Migrate NSErrorChecker and DereferenceChecker to CheckerV2.Argyrios Kyrtzidis2011-02-281-1/+1
| | | | | | | | They cooperate in that NSErrorChecker listens for ImplicitNullDerefEvent events that DereferenceChecker can dispatch. ImplicitNullDerefEvent is when we dereferenced a location that may be null. llvm-svn: 126659
* [analyzer] Remove '-analyzer-experimental-internal-checks' flag, it doesn't ↵Argyrios Kyrtzidis2011-02-241-1/+1
| | | | | | have any checkers associated with it anymore. llvm-svn: 126440
* Tweak null dereference checker to give better diagnostics for null ↵Ted Kremenek2010-10-261-5/+5
| | | | | | dereferences resulting from array accesses. llvm-svn: 117334
* Tweak retain/release checker diagnostics to specify a leak occurs because an ↵Ted Kremenek2010-10-151-2/+2
| | | | | | | | object is not referenced later in the path, not that it isn't referenced later in the code. Fixes <rdar://problem/8527839>. llvm-svn: 116636
* Use FindReportInEquivalenceClass to identify all the nodes used for the ↵Ted Kremenek2010-09-091-1/+259
| | | | | | | | | | trimmed graph (in BugReporter). This fixes a problem where a leak that happened to occur on both an exit() path and a non-exit() path was getting reported with the exit() path (which users don't care about). This fixes: <rdar://problem/8331641> leak reports should not show paths that end with exit() (but ones that don't end with exit()) llvm-svn: 113524
* Rename GRState::getSVal() -> getRawSVal() and getSimplifiedSVal() -> getSVal().Ted Kremenek2010-09-091-0/+756
The end result is now we eagarly constant-fold symbols in the analyzer that are perfectly constrained to be a constant value. This allows us to recover some path-sensitivity in some cases by lowering the required level of reasoning power needed to evaluate some expressions. The net win from this change is that the false positive in PR 8015 is fixed, and we also find more idempotent operations bugs. We do, however, regress with the BugReporterVisitors, which need to be modified to understand this constant folding (and look past it). This causes some diagnostic regressions in plist-output.m which will get addressed in a future patch. plist-output.m is now marked XFAIL, while plist-output-alternate.m now tests that the plist output is working, but with the suboptimal diagnostics. This second test file will eventually be removed. llvm-svn: 113477
OpenPOWER on IntegriCloud