summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis/ptr-arith.c
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Move analyzer-eagerly-assume to AnalyzerOptions, enable by defaultGeorge Karpenkov2018-08-291-2/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D51251 llvm-svn: 340963
* [Analyzer] Constraint Manager Negates DifferenceAdam Balogh2018-06-281-23/+0
| | | | | | | | If range [m .. n] is stored for symbolic expression A - B, then we can deduce the range for B - A which is [-n .. -m]. This is only true for signed types, unless the range is [0 .. 0]. Differential Revision: https://reviews.llvm.org/D35110 llvm-svn: 335814
* [analyzer] [PointerArithChecker] do not warn on indexes into vector typesGeorge Karpenkov2018-03-071-0/+6
| | | | | | | | rdar://35041502 Differential Revision: https://reviews.llvm.org/D44172 llvm-svn: 326952
* [analyzer] Fix handling of labels in getLValueElementAlexander Shaposhnikov2017-10-231-0/+5
| | | | | | | | | | | In getLValueElement Base may represent the address of a label (as in the newly-added test case), in this case it's not a loc::MemRegionVal and Base.castAs<loc::MemRegionVal>() triggers an assert, this diff makes getLValueElement return UnknownVal instead. Differential revision: https://reviews.llvm.org/D39174 llvm-svn: 316399
* Reland 4: [analyzer] NFC: Update test infrastructure to support multiple ↵Dominic Chen2017-03-031-8/+37
| | | | | | | | | | | | | | constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296895
* Revert "Reland 3: [analyzer] NFC: Update test infrastructure to support ↵Dominic Chen2017-03-021-37/+8
| | | | | | | | multiple constraint managers" This reverts commit ea36f1406e1f36bf456c3f3929839b024128e468. llvm-svn: 296841
* Reland 3: [analyzer] NFC: Update test infrastructure to support multiple ↵Dominic Chen2017-03-021-8/+37
| | | | | | | | | | | | | | constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296837
* Revert "Reland 2: [analyzer] NFC: Update test infrastructure to support ↵Dominic Chen2017-03-021-37/+8
| | | | | | | | multiple constraint managers" This reverts commit f93343c099fff646a2314cc7f4925833708298b1. llvm-svn: 296836
* Reland 2: [analyzer] NFC: Update test infrastructure to support multiple ↵Dominic Chen2017-03-021-8/+37
| | | | | | | | | | | | | | constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296835
* Revert "Reland: [analyzer] NFC: Update test infrastructure to support ↵Dominic Chen2017-02-281-37/+8
| | | | | | | | multiple constraint managers" This reverts commit 1b28d0b10e1c8feccb971abb6ef7a18bee589830. llvm-svn: 296422
* Reland: [analyzer] NFC: Update test infrastructure to support multiple ↵Dominic Chen2017-02-281-8/+37
| | | | | | | | | | | | | | constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296414
* Revert "[analyzer] NFC: Update test infrastructure to support multiple ↵Dominic Chen2017-02-271-37/+8
| | | | | | | | constraint managers" This reverts commit 8e7780b9e59ddaad1800baf533058d2c064d4787. llvm-svn: 296317
* [analyzer] NFC: Update test infrastructure to support multiple constraint ↵Dominic Chen2017-02-271-8/+37
| | | | | | | | | | | | | | managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296312
* [analyzer] Improve pointer arithmetic checker.Gabor Horvath2016-02-231-2/+2
| | | | | | | | | | | This patch is intended to improve pointer arithmetic checker. From now on it only warns when the pointer arithmetic is likely to cause an error. For example when the pointer points to a single object, or an array of derived types. Differential Revision: http://reviews.llvm.org/D14203 llvm-svn: 261632
* [analyzer] A fix for substraction of an integer from a pointer.Gabor Horvath2015-09-181-0/+17
| | | | | | | | Patch by Artem Dergachev! Differential Revision: http://reviews.llvm.org/D12725 llvm-svn: 248021
* PR16074, implement warnings to catch pointer to boolean true and pointer toRichard Trieu2014-02-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | null comparison when the pointer is known to be non-null. This catches the array to pointer decay, function to pointer decay and address of variables. This does not catch address of function since this has been previously used to silence a warning. Pointer to bool conversion is under -Wbool-conversion. Pointer to null comparison is under -Wtautological-pointer-compare, a sub-group of -Wtautological-compare. void foo() { int arr[5]; int x; // warn on these conditionals if (foo); if (arr); if (&x); if (foo == null); if (arr == null); if (&x == null); if (&foo); // no warning } llvm-svn: 202216
* [analyzer] Use a more generic MemRegion.getAsOffset to evaluate bin ↵Anna Zaks2013-05-281-0/+16
| | | | | | | | | operators on MemRegions In addition to enabling more code reuse, this suppresses some false positives by allowing us to compare an element region to its base. See the ptr-arith.cpp test cases for an example. llvm-svn: 182780
* [analyzer] Also transform "a < b" to "(b - a) > 0" in the constraint manager.Jordan Rose2013-03-231-0/+44
| | | | | | | | | | | | We can support the full range of comparison operations between two locations by canonicalizing them as subtraction, as in the previous commit. This won't work (well) if either location includes an offset, or (again) if the comparisons are not consistent about which region comes first. <rdar://problem/13239003> llvm-svn: 177803
* [analyzer] Translate "a != b" to "(b - a) != 0" in the constraint manager.Jordan Rose2013-03-231-0/+57
| | | | | | | | | | | | | | | | | | | | | | | Canonicalizing these two forms allows us to better model containers like std::vector, which use "m_start != m_finish" to implement empty() but "m_finish - m_start" to implement size(). The analyzer should have a consistent interpretation of these two symbolic expressions, even though it's not properly reasoning about either one yet. The other unfortunate thing is that while the size() expression will only ever be written "m_finish - m_start", the comparison may be written "m_finish == m_start" or "m_start == m_finish". Right now the analyzer does not attempt to canonicalize those two expressions, since it doesn't know which length expression to pick. Doing this correctly will probably require implementing unary minus as a new SymExpr kind (<rdar://problem/12351075>). For now, the analyzer inverts the order of arguments in the comparison to build the subtraction, on the assumption that "begin() != end()" is written more often than "end() != begin()". This is purely speculation. <rdar://problem/13239003> llvm-svn: 177801
* [analyzer] Use SymExprs to represent '<loc> - <loc>' and '<loc> == <loc>'.Jordan Rose2013-03-231-0/+12
| | | | | | | | | | We just treat this as opaque symbols, but even that allows us to handle simple cases where the same condition is tested twice. This is very common in the STL, which means that any project using the STL gets spurious errors. Part of <rdar://problem/13239003>. llvm-svn: 177800
* Fix analyzer tests.Ted Kremenek2012-08-241-2/+2
| | | | llvm-svn: 162588
* Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the ↵Ted Kremenek2012-08-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | same time. This fixes several issues: - removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer, but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer was used by itself. - emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special case, just another PathDiagnosticConsumer. This also magically resolved some duplicate warnings, as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine). As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped, just like with diagnostics emitted to plists and HTML. This required some tests to be updated, but now the tests have higher fidelity with what users will see. There are some inefficiencies in this patch. We currently generate the report graph (from the ExplodedGraph) once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the logic stack. There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue) for different PathDiagnosticConsumers. This is necessary to produce the diagnostics that a particular consumer expects. llvm-svn: 162028
* [analyzer] Convert many existing tests to use clang_analyzer_eval.Jordy Rose2012-05-161-168/+49
| | | | llvm-svn: 156920
* Teach SimpleSValBuilder that (in the absence of more information) stack ↵Ted Kremenek2012-03-051-1/+1
| | | | | | memory doesn't alias symbolic memory. This is a heuristic/hack, but works well in practice. Fixes <rdar://problem/10978247>. llvm-svn: 152065
* [analyzer] rename all experimental checker packages to have 'experimental' ↵Ted Kremenek2011-08-031-2/+2
| | | | | | be the common root package. llvm-svn: 136835
* [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best ↵Argyrios Kyrtzidis2011-02-281-2/+2
| | | | | | misnomer award. llvm-svn: 126676
* Allow passing a list of comma separated checker names to -analyzer-checker, e.g:Argyrios Kyrtzidis2011-02-241-2/+2
| | | | | | -analyzer-checker=cocoa,unix llvm-svn: 126372
* [analyzer] Use the new registration mechanism on some of the experimental ↵Argyrios Kyrtzidis2011-02-151-2/+2
| | | | | | | | | | | internal checkers: CastToStructChecker FixedAddressChecker PointerArithChecker PointerSubChecker llvm-svn: 125612
* Pointers casted as integers still count as locations to SimpleSValuator, so ↵Jordy Rose2010-06-301-0/+5
| | | | | | don't crash if we do a funny thing like ((int)ptr)&1. Fixes PR7527. llvm-svn: 107236
* Pointer comparisons (and pointer-pointer subtraction). Basically filling in ↵Jordy Rose2010-06-281-0/+221
| | | | | | SimpleSValuator::EvalBinOpLL(). llvm-svn: 106992
* Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.Ted Kremenek2010-02-051-2/+2
| | | | llvm-svn: 95348
* Update tests to use %clang_cc1 instead of 'clang-cc' or 'clang -cc1'.Daniel Dunbar2009-12-151-2/+2
| | | | | | | | | - This is designed to make it obvious that %clang_cc1 is a "test variable" which is substituted. It is '%clang_cc1' instead of '%clang -cc1' because it can be useful to redefine what gets run as 'clang -cc1' (for example, to set a default target). llvm-svn: 91446
* Replace clang-cc with clang -cc1.Zhongxing Xu2009-12-141-2/+2
| | | | llvm-svn: 91272
* Add clang-cc option "--analyzer-experimental-internal-checks". ThisTed Kremenek2009-11-131-2/+2
| | | | | | | option enables new "internal" checks that will eventually be turned on by default but still require broader testing. llvm-svn: 88671
* Add test case for PointerSubChecker.Zhongxing Xu2009-11-101-0/+5
| | | | llvm-svn: 86657
* Refine PointerSubChecker: compare the base region instead of the original Zhongxing Xu2009-11-101-0/+5
| | | | | | region, so that arithmetic within a memory chunk is allowed. llvm-svn: 86652
* update test case.Zhongxing Xu2009-11-091-1/+1
| | | | llvm-svn: 86541
* Add check for pointer arithmetic on non-array variables.Zhongxing Xu2009-11-091-0/+9
| | | | llvm-svn: 86538
* Add checker for CWE-587: Assignment of a Fixed Address to a Pointer.Zhongxing Xu2009-11-091-0/+5
| | | | llvm-svn: 86523
* Add checker for CWE-469: Use of Pointer Subtraction to Determine Size. ThisZhongxing Xu2009-11-091-0/+5
| | | | | | | checker does not build sink nodes. Because svaluator computes an unknown value for the subtraction now. llvm-svn: 86517
* Eliminate &&s in tests.Daniel Dunbar2009-11-081-1/+1
| | | | | | - 'for i in $(find . -type f); do sed -e 's#\(RUN:.*[^ ]\) *&& *$#\1#g' $i | FileUpdate $i; done', for the curious. llvm-svn: 86430
* Introduce a new concept to the static analyzer: SValuator.Ted Kremenek2009-06-261-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | GRTransferFuncs had the conflated role of both constructing SVals (symbolic expressions) as well as handling checker-specific logic. Now SValuator has the role of constructing SVals from expressions and GRTransferFuncs just handles checker-specific logic. The motivation is by separating these two concepts we will be able to much more easily create richer constraint-generating logic without coupling it to the main checker transfer function logic. We now have one implementation of SValuator: SimpleSValuator. SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals (which is removed in this patch). This includes the logic for EvalBinOp, EvalCast, etc. Because SValuator has a narrower role than the old GRTransferFuncs, the interfaces are much simpler, and so is the implementation of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of SVal-related logic in GRSimpleVals and cleaned it up while moving it over to SimpleSValuator. As a consequence of removing GRSimpleVals, there is no longer a '-checker-simple' option. The '-checker-cfref' did everything that option did but also ran the retain/release checker. Of course a user may not always wish to run the retain/release checker, nor do we wish core analysis logic buried in the checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp to separate out these pieces into the core analysis engine. llvm-svn: 74229
* Clean up builtin lists, add a few new builtins. (I re-sorted the Eli Friedman2009-06-041-1/+1
| | | | | | | string.h builtins to be in the same order as the list in the C99 standard.) llvm-svn: 72882
* Rename clang to clang-cc.Daniel Dunbar2009-03-241-3/+3
| | | | | | Tests and drivers updated, still need to shuffle dirs. llvm-svn: 67602
* Fix failure reported by Sebastian of test/Analysis/ptr-arith.c when the targetTed Kremenek2009-03-131-1/+3
| | | | | | | | | | is 64-bit. I used his suggestion of doing a direct bitwidth/signedness conversion of the 'offset' instead of just changing the sign. For more information, see: http://lists.cs.uiuc.edu/pipermail/cfe-dev/2009-March/004587.html llvm-svn: 66892
* Add comments to test case.Zhongxing Xu2009-03-121-0/+3
| | | | llvm-svn: 66760
* This test case checks if we get the right rvalue type of a TypedViewRegion.Zhongxing Xu2009-03-111-0/+15
| | | | | | | The ElementRegion's type depends on the array region's rvalue type. If it was a pointer type, we would get a loc::SymbolVal for '*p'. llvm-svn: 66656
* Fix crash when LHS of pointer arithmetic is not ElementRegion.Zhongxing Xu2009-03-111-0/+7
| | | | llvm-svn: 66649
* Add test case for pointer arithmetic.Zhongxing Xu2009-03-031-0/+7
llvm-svn: 65907
OpenPOWER on IntegriCloud