summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
* [Analyzer] [HOTFIX!] SValBuilder crash when ↵Adam Balogh2018-12-051-0/+14
| | | | | | | | | | | | | `aggressive-binary-operation-simplification` enabled During the review of D41938 a condition check with an early exit accidentally slipped into a branch, leaving the other branch unprotected. This may result in an assertion later on. This hotfix moves this contition check outside of the branch. Differential Revision: https://reviews.llvm.org/D55051 llvm-svn: 348362
* [analyzer] Fix eliding the same destructor twice due to buggy default arguments.Artem Dergachev2018-07-311-0/+15
| | | | | | | | | | | Because of incomplete support for CXXDefaultArgExpr, we cannot yet commit to asserting that the same destructor won't be elided twice. Suppress the assertion failure for now. Proper support is still an open problem. Differential Revision: https://reviews.llvm.org/D49213 llvm-svn: 338441
* [CFG] [analyzer] Implement function argument construction contexts.Artem Dergachev2018-07-312-16/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | In r330377 and r338425 we have already identified what constitutes function argument constructors and added stubs in order to prevent confusing them with other temporary object constructors. Now we implement a ConstructionContext sub-class to carry all the necessary information about the construction site, namely call expression and argument index. On the analyzer side, the patch interacts with the recently implemented pre-C++17 copy elision support in an interesting manner. If on the CFG side we didn't find a construction context for the elidable constructor, we build the CFG as if the elidable constructor is not elided, and the non-elided constructor within it is a simple temporary. But the same problem may occur in the analyzer: if the elidable constructor has a construction context but the analyzer doesn't implement such context yet, the analyzer should also try to skip copy elision and still inline the non-elided temporary constructor. This was implemented by adding a "roll back" mechanism: when elision fails, roll back the changes and proceed as if it's a simple temporary. The approach is wonky, but i'm fine with that as long as it's merely a defensive mechanism that should eventually go away once all construction contexts become supported. Differential Revision: https://reviews.llvm.org/D48681. llvm-svn: 338436
* [analyzer] Move InnerPointerChecker out of alpha.Reka Kovacs2018-07-311-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D49058 llvm-svn: 338433
* [CFG] [analyzer] Add construction contexts for returning C++ objects in ObjC++.Artem Dergachev2018-07-312-0/+89
| | | | | | | | | | | Like any normal funciton, Objective-C message can return a C++ object in Objective-C++. Such object would require a construction context. This patch, therefore, is an extension of r327343 onto Objective-C++. Differential Revision: https://reviews.llvm.org/D48608 llvm-svn: 338426
* [CFG] [analyzer] Add stubs for constructor and message argument constructors.Artem Dergachev2018-07-314-4/+125
| | | | | | | | | | | | | | | | | | CFG now correctly identifies construction context for temporaries constructed for the purpose of passing into a function as an argument. Such context is still not fully implemented because the information it provides is not rich enough: it doens't contain information about argument index. It will be addresssed later. This patch is an extension of r330377 to C++ construct-expressions and Objective-C message expressions which aren't call-expressions but require similar handling. C++ new-expressions with placement arguments still remain to be handled. Differential Revision: https://reviews.llvm.org/D49826 llvm-svn: 338425
* [analyzer] Don't try to simplify mixed Loc/NonLoc expressions.Artem Dergachev2018-07-311-0/+7
| | | | | | | | | | | | | | | | | | This fix is similar to r337769 and addresses a regression caused by r337167. When an operation between a nonloc::LocAsInteger and a non-pointer symbol is performed, the LocAsInteger-specific part of information is lost. When the non-pointer symbol is collapsing into a constant, we cannot easily re-evaluate the result, because we need to recover the missing LocAsInteger-specific information (eg., integer type, or the very fact that this pointer was at some point converted to an integer). Add one more defensive check to prevent crashes on trying to simplify a SymSymExpr with different Loc-ness of operands. Differential Revision: llvm-svn: 338420
* [analyzer] Rename test: cxx17-mandatory-elision.cpp -> copy-elision.cppArtem Dergachev2018-07-311-0/+0
| | | | | | It reflects its contents more accurately. No functional change intended. llvm-svn: 338339
* [analyzer] CStringChecker: Remember to highlight the argument expression range.Artem Dergachev2018-07-301-0/+15
| | | | | | | | | | | | | | | | | | | | | When emitting a bug report, it is important to highlight which argument of the call-expression is causing the problem. Before: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^~~~~~~~~~~~ After: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^      ~ Affects other output modes as well, not just text. Differential Revision: https://reviews.llvm.org/D50028 llvm-svn: 338333
* [analyzer] Bugfix for autorelease + main run loop leak checkerGeorge Karpenkov2018-07-301-0/+11
| | | | | | | | | Do not warn when the other message-send-expression is correctly wrapped in a different autorelease pool. Differential Revision: https://reviews.llvm.org/D49921 llvm-svn: 338314
* [analyzer] Fix crash in RunLoopAutoreleaseChecker on empty childrenGeorge Karpenkov2018-07-301-1/+10
| | | | | | Differential Revision: https://reviews.llvm.org/D50012 llvm-svn: 338312
* [analyzer] Add support for more invalidating functions in InnerPointerChecker.Reka Kovacs2018-07-301-10/+82
| | | | | | | | | | | | According to the standard, pointers referring to the elements of a `basic_string` may be invalidated if they are used as an argument to any standard library function taking a reference to non-const `basic_string` as an argument. This patch makes InnerPointerChecker warn for these cases. Differential Revision: https://reviews.llvm.org/D49656 llvm-svn: 338259
* [analyzer] Extend NoStoreFuncVisitor to insert a note on IVarsGeorge Karpenkov2018-07-272-4/+50
| | | | | | | | | | | | | | The note is added in the following situation: - We are throwing a nullability-related warning on an IVar - The path goes through a method which *could have* (syntactically determined) written into that IVar, but did not rdar://42444460 Differential Revision: https://reviews.llvm.org/D49689 llvm-svn: 338149
* Add missing temporary materialization conversion on left-hand side of .Richard Smith2018-07-273-240/+256
| | | | | | | | | in some member function calls. Specifically, when calling a conversion function, we would fail to create the AST node representing materialization of the class object. llvm-svn: 338135
* [analyzer] Syntactic matcher for leaks associated with run loop and ↵George Karpenkov2018-07-252-0/+108
| | | | | | | | | | | | | | | | | | | | | | | autoreleasepool A checker for detecting leaks resulting from allocating temporary autoreleasing objects before starting the main run loop. Checks for two antipatterns: 1. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in the same autorelease pool. 2. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in no autorelease pool. Happens-before relationship is modeled purely syntactically. rdar://39299145 Differential Revision: https://reviews.llvm.org/D49528 llvm-svn: 337876
* Revert "[analyzer] Extend NoStoreFuncVisitor to insert a note on IVars"George Karpenkov2018-07-242-50/+4
| | | | | | | This reverts commit a9e21bd727112cd69eabc1af648c5da6b773d06e. Reverted because the dependency has not landed yet. llvm-svn: 337866
* [analyzer] Extend NoStoreFuncVisitor to insert a note on IVarsGeorge Karpenkov2018-07-242-4/+50
| | | | | | | | | | | | | | The note is added in the following situation: - We are throwing a nullability-related warning on an IVar - The path goes through a method which *could have* (syntactically determined) written into that IVar, but did not rdar://42444460 Differential Revision: https://reviews.llvm.org/D49689 llvm-svn: 337864
* [analyzer] Add a no-crash to a recently added test.Artem Dergachev2018-07-231-1/+1
| | | | | | No functional change intended. llvm-svn: 337776
* [analyzer] pr38273: Legalize Loc<>NonLoc comparison symbols.Artem Dergachev2018-07-231-0/+4
| | | | | | | | | Remove an assertion in RangeConstraintManager that expects such symbols to never appear, while admitting that the constraint manager doesn't yet handle them. Differential Revision: https://reviews.llvm.org/D49703 llvm-svn: 337769
* Fold -Wreturn-stack-address into general initialization lifetimeRichard Smith2018-07-233-4/+4
| | | | | | checking. llvm-svn: 337743
* Fold dangling-field warning into general initialization lifetime checks.Richard Smith2018-07-231-6/+6
| | | | | | | This reinstates r337627, reverted in r337671, with a fix to correctly handle the lvalueness of array subscript expressions on pointers. llvm-svn: 337726
* [CStringSyntaxChecker] Improvements of strlcpy checkDavid Carlier2018-07-231-0/+1
| | | | | | | | | | | | Adding an additional check whenwe offset fro the buffer base address. Reviewers: george.karpenkov,NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D49633 llvm-svn: 337721
* Fix for last commit: adding new test file forgotten.Adam Balogh2018-07-231-0/+43
| | | | llvm-svn: 337679
* [Analyzer] Quick Fix for exponential execution time when simpilifying ↵Adam Balogh2018-07-234-4/+67
| | | | | | | | | | | | | | | | | | complex additive expressions Patch https://reviews.llvm.org/rC329780 not only rearranges comparisons but also binary expressions. This latter behavior is not protected by the analyzer option. Hower, since no complexity threshold is enforced to the symbols this may result in exponential execution time if the expressions are too complex: https://bugs.llvm.org/show_bug.cgi?id=38208. For a quick fix we extended the analyzer option to also cover the additive cases. This is only a temporary fix, the final solution should be enforcing the complexity threshold to the symbols. Differential Revision: https://reviews.llvm.org/D49536 llvm-svn: 337678
* Revert "Fold dangling-field warning into general initialization lifetime ↵Ilya Biryukov2018-07-231-6/+6
| | | | | | | | | | | | | | | | checks." This reverts commit r337627. After the change, clang started producing invalid warning on the following code: struct foo { foo(char *x) : x_(&x[10]) {} private: char *x_; }; 1.cpp:2:21: warning: initializing pointer member 'x_' with the stack address of parameter 'x' [-Wdangling-field] llvm-svn: 337671
* Fold dangling-field warning into general initialization lifetime checks.Richard Smith2018-07-201-6/+6
| | | | llvm-svn: 337627
* [CStringSyntaxChecker] Fix build bot builds != x86 archsDavid Carlier2018-07-201-0/+4
| | | | | | | | | | Reviewers: NoQ,george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D49588 llvm-svn: 337611
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-201-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* [CStringSyntaxChecker] Check strlcpy sizeof syntaxDavid Carlier2018-07-192-1/+16
| | | | | | | | | | | | | | | | | The last argument is expected to be the destination buffer size (or less). Detects if it points to destination buffer size directly or via a variable. Detects if it is an integral, try to detect if the destination buffer can receive the source length. Updating bsd-string.c unit tests as it make it fails now. Reviewers: george.karpenpov, NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D48884 llvm-svn: 337499
* [analyzer] Add support for more basic_string API inReka Kovacs2018-07-191-60/+200
| | | | | | | | | | | | | DanglingInternalBufferChecker. A pointer referring to the elements of a basic_string may be invalidated by calling a non-const member function, except operator[], at, front, back, begin, rbegin, end, and rend. The checker now warns if the pointer is used after such operations. Differential Revision: https://reviews.llvm.org/D49360 llvm-svn: 337463
* Restructure checking for, and warning on, lifetime extension.Richard Smith2018-07-171-23/+0
| | | | | | | | | | | | | This change implements C++ DR1696, which makes initialization of a reference member of a class from a temporary object ill-formed. The standard wording here is imprecise, but we interpret it as meaning that any time a mem-initializer would result in lifetime extension, the program is ill-formed. This reinstates r337226, reverted in r337255, with a fix for the InitializedEntity alignment problem that was breaking ARM buildbots. llvm-svn: 337329
* Temporarily revert r337226 "Restructure checking for, and warning on, ↵Florian Hahn2018-07-171-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | lifetime extension." This change breaks on ARM because pointers to clang::InitializedEntity are only 4 byte aligned and do not have 3 bits to store values. A possible solution would be to change the fields in clang::InitializedEntity to enforce a bigger alignment requirement. The error message is llvm/include/llvm/ADT/PointerIntPair.h:132:3: error: static_assert failed "PointerIntPair with integer size too large for pointer" static_assert(IntBits <= PtrTraits::NumLowBitsAvailable, include/llvm/ADT/PointerIntPair.h:73:13: note: in instantiation of template class 'llvm::PointerIntPairInfo<const clang::InitializedEntity *, 3, llvm::PointerLikeTypeTraits<const clang::InitializedEntity *> >' requested here Value = Info::updateInt(Info::updatePointer(0, PtrVal), llvm/include/llvm/ADT/PointerIntPair.h:51:5: note: in instantiation of member function 'llvm::PointerIntPair<const clang::InitializedEntity *, 3, (anonymous namespace)::LifetimeKind, llvm::PointerLikeTypeTraits<const clang::InitializedEntity *>, llvm::PointerIntPairInfo<const clang::InitializedEntity *, 3, llvm::PointerLikeTypeTraits<const clang::InitializedEntity *> > >::setPointerAndInt' requested here setPointerAndInt(PtrVal, IntVal); ^ llvm/tools/clang/lib/Sema/SemaInit.cpp:6237:12: note: in instantiation of member function 'llvm::PointerIntPair<const clang::InitializedEntity *, 3, (anonymous namespace)::LifetimeKind, llvm::PointerLikeTypeTraits<const clang::InitializedEntity *>, llvm::PointerIntPairInfo<const clang::InitializedEntity *, 3, llvm::PointerLikeTypeTraits<const clang::InitializedEntity *> > >::PointerIntPair' requested here return {Entity, LK_Extended}; Full log here: http://lab.llvm.org:8011/builders/clang-cmake-armv7-global-isel/builds/1330 http://lab.llvm.org:8011/builders/clang-cmake-armv7-full/builds/1394 llvm-svn: 337255
* [analyzer] Fix size_t in tests.Artem Dergachev2018-07-171-1/+2
| | | | | | Should fix a buildbot. No functional change intended. llvm-svn: 337231
* [CFG] [analyzer] Allow elidable copies to have more than one arguments.Artem Dergachev2018-07-171-0/+23
| | | | | | | | | | Copy-constructors and move-constructors may have default arguments. It is incorrect to assert that they only have one argument, i.e. the reference to the object being copied or moved. Remove the assertion. Differential Revision: https://reviews.llvm.org/D49215 llvm-svn: 337229
* [analyzer] pr37802: Fix symbolic-pointer-to-boolean casts during load.Artem Dergachev2018-07-172-0/+112
| | | | | | | | | The canonical representation of pointer &SymRegion{$x} casted to boolean is "$x != 0", not "$x". Assertion added in r337227 catches that. Differential Revision: https://reviews.llvm.org/D48232 llvm-svn: 337228
* Restructure checking for, and warning on, lifetime extension.Richard Smith2018-07-171-23/+0
| | | | | | | | | | This change implements C++ DR1696, which makes initialization of a reference member of a class from a temporary object ill-formed. The standard wording here is imprecise, but we interpret it as meaning that any time a mem-initializer would result in lifetime extension, the program is ill-formed. llvm-svn: 337226
* [analyzer] Bugfix for an overly eager suppression for null pointer return ↵George Karpenkov2018-07-161-0/+23
| | | | | | | | | | | | | from macros. Only suppress those cases where the null which came from the macro is relevant to the bug, and was not overwritten in between. rdar://41497323 Differential Revision: https://reviews.llvm.org/D48856 llvm-svn: 337213
* [analyzer] Fix GCDAntipatternChecker to only fire when the semaphore is ↵George Karpenkov2018-07-161-0/+10
| | | | | | | | | | | | initialized to zero Initializing a semaphore with a different constant most likely signals a different intent rdar://41802552 Differential Revision: https://reviews.llvm.org/D48911 llvm-svn: 337212
* [analyzer] Fix constraint being dropped when analyzing a program without ↵Mikhail R. Gadelha2018-07-164-24/+22
| | | | | | | | | | | | | | | | | | | | | | | taint tracking enabled Summary: This patch removes the constraint dropping when taint tracking is disabled. It also voids the crash reported in D28953 by treating a SymSymExpr with non pointer symbols as an opaque expression. Updated the regressions and verifying the big projects now; I'll update here when they're done. Based on the discussion on the mailing list and the patches by @ddcc. Reviewers: george.karpenkov, NoQ, ddcc, baloghadamsoftware Reviewed By: george.karpenkov Subscribers: delcypher, llvm-commits, rnkovacs, xazax.hun, szepet, a.sidorin, ddcc Differential Revision: https://reviews.llvm.org/D48650 llvm-svn: 337167
* [Analyzer] alpha.unix.cstring.OutOfBounds checker enable/disable fixAdam Balogh2018-07-133-17/+53
| | | | | | | | | | | | | | | | | | It was not possible to disable alpha.unix.cstring.OutOfBounds checker's reports since unix.Malloc checker always implicitly enabled the filter. Moreover if the checker was disabled from command line (-analyzer-disable-checker ..) the out of bounds warnings were nevertheless emitted under different checker names such as unix.cstring.NullArg, or unix.Malloc. This patch fixes the case sot that Malloc checker only enables implicitly the underlying modeling of strcpy, memcpy etc. but not the warning messages that would have been emmitted by alpha.unix.cstring.OutOfBounds Patch by: Dániel Krupp Differential Revision: https://reviews.llvm.org/D48831 llvm-svn: 337000
* [analyzer][UninitializedObjectChecker] Fixed captured lambda variable nameKristof Umann2018-07-131-3/+48
| | | | | | Differential Revision: https://reviews.llvm.org/D48291 llvm-svn: 336995
* [analyzer][UninitializedObjectChecker] Support for MemberPointerTypesKristof Umann2018-07-131-8/+4
| | | | | | Differential Revision: https://reviews.llvm.org/D48325 llvm-svn: 336994
* [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.Reka Kovacs2018-07-111-0/+24
| | | | | | | | | | | | Previously, the checker only tracked one raw pointer symbol for each container object. But member functions returning a pointer to the object's inner buffer may be called on the object several times. These pointer symbols are now collected in a set inside the program state map and thus all of them is checked for use-after-free problems. Differential Revision: https://reviews.llvm.org/D49057 llvm-svn: 336835
* [analyzer] Fix bots by changing the analyzer-config tests.George Karpenkov2018-07-112-4/+2
| | | | | | To be investigated. llvm-svn: 336756
* [analyzer] Add support for data() in DanglingInternalBufferChecker.Reka Kovacs2018-07-071-9/+53
| | | | | | | | | DanglingInternalBufferChecker now tracks use-after-free problems related to the incorrect usage of std::basic_string::data(). Differential Revision: https://reviews.llvm.org/D48532 llvm-svn: 336497
* [analyzer] Highlight c_str() call in DanglingInternalBufferChecker.Reka Kovacs2018-07-071-5/+17
| | | | | | | | | | Add a bug visitor to DanglingInternalBufferChecker that places a note at the point where the dangling pointer was obtained. The visitor is handed over to MallocChecker and attached to the report there. Differential Revision: https://reviews.llvm.org/D48522 llvm-svn: 336495
* [analyzer] Highlight container object destruction in MallocChecker.Reka Kovacs2018-07-071-4/+4
| | | | | | | | | Extend MallocBugVisitor to place a note at the point where objects with AF_InternalBuffer allocation family are destroyed. Differential Revision: https://reviews.llvm.org/D48521 llvm-svn: 336489
* [analyzer][ctu] fix unsortable diagnosticsRafael Stahl2018-07-044-0/+18
| | | | | | | | | | | | | | Summary: In the provided test case the PathDiagnostic compare function was not able to find a difference. Reviewers: xazax.hun, NoQ, dcoughlin, george.karpenkov Reviewed By: george.karpenkov Subscribers: a_sidorin, szepet, rnkovacs, a.sidorin, mikhail.ramalho, cfe-commits Differential Revision: https://reviews.llvm.org/D48474 llvm-svn: 336275
* [analyzer][UninitializedObjectChecker] Added a NotesAsWarnings flagKristof Umann2018-06-291-0/+15
| | | | | | | | | | In order to better support consumers of the plist output that don't parse note entries just yet, a 'NotesAsWarnings' flag was added. If it's set to true, all notes will be converted to warnings. Differential Revision: https://reviews.llvm.org/D48285 llvm-svn: 335964
* [analyzer] fix test case expected warningMikhail R. Gadelha2018-06-281-8/+0
| | | | | | | | | After r335814, the constraint manager is no longer generating a false bug report about the division by zero in the test case. This patch removes the expected false bug report. llvm-svn: 335932
OpenPOWER on IntegriCloud