summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Teach RetainCountChecker about CVFooRetainDevin Coughlin2016-08-111-0/+20
| | | | | | | | | | | | Change the retain count checker to treat CoreFoundation-style "CV"-prefixed reference types from CoreVideo similarly to CoreGraphics types. With this change, we treat CVFooRetain() on a CVFooRef type as a retain. CVFooRelease() APIs are annotated as consuming their parameter, so this change prevents false positives about incorrect decrements of reference counts. <rdar://problem/27116090> llvm-svn: 278382
* [analyzer] Fix a crash in CloneDetector when calling functions by pointers.Artem Dergachev2016-08-101-0/+12
| | | | | | | | | | | CallExpr may have a null direct callee when the callee function is not known in compile-time. Do not try to take callee name in this case. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23320 llvm-svn: 278238
* [analyzer] Change -analyze-function to accept qualified names.Artem Dergachev2016-08-084-27/+61
| | | | | | | | | | | | | | | Both -analyze-function and -analyzer-display-progress now share the same convention for naming functions, which allows discriminating between methods with the same name in different classes, C++ overloads, and also presents Objective-C instance and class methods in the convenient notation. This also allows looking up the name for the particular function you're trying to restrict analysis to in the -analyzer-display-progress output, in case it was not instantly obvious. Differential Revision: https://reviews.llvm.org/D22856 llvm-svn: 278018
* [analyzer] Command line option to show enabled checker list.Gabor Horvath2016-08-081-0/+20
| | | | | | | | | | | | This patch adds a command line option to list the checkers that were enabled by analyzer-checker and not disabled by -analyzer-disable-checker. It can be very useful to debug long command lines when it is not immediately apparent which checkers are turned on and which checkers are turned off. Differential Revision: https://reviews.llvm.org/D23060 llvm-svn: 278006
* [analyzer] Model base to derived casts more precisely.Gabor Horvath2016-08-081-0/+16
| | | | | | | | | | | | | | Dynamic casts are handled relatively well by the static analyzer. BaseToDerived casts however are treated conservatively. This can cause some false positives with the NewDeleteLeaks checker. This patch alters the behavior of BaseToDerived casts. In case a dynamic cast would succeed use the same semantics. Otherwise fall back to the conservative approach. Differential Revision: https://reviews.llvm.org/D23014 llvm-svn: 277989
* [analyzer] Make CloneDetector recognize different variable patterns.Artem Dergachev2016-08-042-22/+9
| | | | | | | | | | | | | | | | | CloneDetector should be able to detect clones with renamed variables. However, if variables are referenced multiple times around the code sample, the usage patterns need to be recognized. For example, (x < y ? y : x) and (y < x ? y : x) are no longer clones, however (a < b ? b : a) is still a clone of the former. Variable patterns are computed and compared during a separate filtering pass. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22982 llvm-svn: 277757
* [analyzer] Hotfix for buildbot failure due to unspecified triple in r277449Artem Dergachev2016-08-021-1/+1
| | | | | | | | | If a target triple is not specified, the default host triple is used, which is not good for compiling inline assembler code. Patch by Raphael Isemann! llvm-svn: 277473
* [analyzer] Respect statement-specific data in CloneDetection.Artem Dergachev2016-08-0214-8/+364
| | | | | | | | | | | | | | | | | So far the CloneDetector only respected the kind of each statement when searching for clones. This patch refines the way the CloneDetector collects data from each statement by providing methods for each statement kind, that will read the kind-specific attributes. For example, statements 'a < b' and 'a > b' are no longer considered to be clones, because they are different in operation code, which is an attribute specific to the BinaryOperator statement kind. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22514 llvm-svn: 277449
* [analyzer] Add basic capabilities to detect source code clones.Artem Dergachev2016-07-265-0/+127
| | | | | | | | | | | | | | | | | | | | | This patch adds the CloneDetector class which allows searching source code for clones. For every statement or group of statements within a compound statement, CloneDetector computes a hash value, and finds clones by detecting identical hash values. This initial patch only provides a simple hashing mechanism that hashes the kind of each sub-statement. This patch also adds CloneChecker - a simple static analyzer checker that uses CloneDetector to report copy-pasted code. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D20795 llvm-svn: 276782
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-211-0/+89
| | | | | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). This reapplies r275820 after fixing a string-lifetime issue discovered by the bots. A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 276365
* Revert "[analyzer] Add checker modeling potential C++ self-assignment"Devin Coughlin2016-07-181-89/+0
| | | | | | This reverts commit r275820. It is failing on the bots. llvm-svn: 275880
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-181-0/+89
| | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 275820
* [analyzer] Add rudimentary handling of AtomicExpr.Devin Coughlin2016-07-081-0/+95
| | | | | | | | | | | | | | This proposed patch adds crude handling of atomics to the static analyzer. Rather than ignore AtomicExprs, as we now do, this patch causes the analyzer to escape the arguments. This is imprecise -- and we should model the expressions fully in the future -- but it is less wrong than ignoring their effects altogether. This is rdar://problem/25353187 Differential Revision: http://reviews.llvm.org/D21667 llvm-svn: 274816
* [analyzer] Suppress false positives in std::shared_ptrDevin Coughlin2016-07-064-125/+183
| | | | | | | | | | | | | | | | | | | | | The analyzer does not model C++ temporary destructors completely and so reports false alarms about leaks of memory allocated by the internals of shared_ptr: std::shared_ptr<int> p(new int(1)); p = nullptr; // 'Potential leak of memory pointed to by field __cntrl_' This patch suppresses all diagnostics where the end of the path is inside a method in std::shared_ptr. It also reorganizes the tests for suppressions in the C++ standard library to use a separate simulated header for library functions with bugs that were deliberately inserted to test suppression. This will prevent other tests from using these as models. rdar://problem/23652766 llvm-svn: 274691
* DeadStoresChecker: Don't warn about dead stores into volatile variablesStephan Bergmann2016-06-241-0/+4
| | | | llvm-svn: 273689
* [analyzer] Teach ObjCDeallocChecker about XCTestCaseDevin Coughlin2016-06-221-0/+22
| | | | | | | | | | | Like with SenTestCase, subclasses of XCTestCase follow a "tear down" idiom to release instance variables and so typically do not release ivars in -dealloc. This commit applies the existing special casing for SenTestCase to XCTestCase as well. rdar://problem/25884696 llvm-svn: 273441
* [analyzer] Teach trackNullOrUndefValue() about class property accessors.Devin Coughlin2016-06-221-0/+28
| | | | | | | | | | Teach trackNullOrUndefValue() how to properly look through PseudoObjectExprs to find the underlying semantic method call for property getters. This fixes a crash when looking through class property getters that I introduced in r265839. rdar://problem/26796666 llvm-svn: 273340
* [analyzer] Add checker to verify the correct usage of the MPI APIDevin Coughlin2016-06-134-0/+478
| | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to verify the correct usage of the MPI API in C and C++. This version updates the reverted r271981 to fix a memory corruption found by the ASan bots. Three path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker A patch by Alexander Droste! Reviewers: zaks.anna, dcoughlin Differential Revision: http://reviews.llvm.org/D21081 llvm-svn: 272529
* Revert "[analyzer] Reapply r271907 (2nd try)."Devin Coughlin2016-06-074-478/+0
| | | | | | | | Even with the fix in r271981, ASan is finding a stack use after return. This reverts commits r271977 and r271981. llvm-svn: 271984
* [analyzer] Reapply r271907 (2nd try).Devin Coughlin2016-06-074-0/+478
| | | | | | | | | | | | | | Second try at reapplying "[analyzer] Add checker for correct usage of MPI API in C and C++." Special thanks to Dan Liew for helping test the fix for the template specialization compiler error with gcc. The original patch is by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271977
* Revert "Reapply "[analyzer] Add checker for correct usage of MPI API in C ↵Devin Coughlin2016-06-064-478/+0
| | | | | | | | and C++."" This reverts commit r271914. It is still breaking bots. llvm-svn: 271920
* Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-064-0/+478
| | | | | | | | | Reapply r271907 with a fix for the compiler error with gcc about specializing clang::ento::ProgramStateTrait in a different namespace. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271914
* Revert "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-064-478/+0
| | | | | | | This reverts commit r271907. It broke a bunch of bots with compile errors about specializations in different namespaces. llvm-svn: 271909
* [analyzer] Add checker for correct usage of MPI API in C and C++.Devin Coughlin2016-06-064-0/+478
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to check for the correct usage of the MPI API in C and C++. 3 path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait. - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call. Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker Reviewers: zaks.anna A patch by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271907
* [Analyzer] Correct stack address escape diagnosticSean Eveson2016-05-261-2/+2
| | | | | | | | | | | | | | | | | | Summary: Leaking a stack address via a static variable refers to it in the diagnostic as a 'global'. This patch corrects the diagnostic for static variables. Patch by Phil Camp, SN Systems Reviewers: dcoughlin, zaks.anna Subscribers: xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D19866 Patch by Phil Camp llvm-svn: 270849
* [analyzer] Fix for PR23790 : constrain return value of strcmp() rather than ↵Anton Yartsev2016-05-191-28/+76
| | | | | | | | | | returning a concrete value. The function strcmp() can return any value, not just {-1,0,1} : "The strcmp(const char *s1, const char *s2) function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by s1 is greater than, equal to, or less than the string pointed to by s2." [C11 7.24.4.2p3] https://llvm.org/bugs/show_bug.cgi?id=23790 http://reviews.llvm.org/D16317 llvm-svn: 270154
* Make Sema::getPrintingPolicy less ridiculously expensive. This used to performRichard Smith2016-05-192-2/+2
| | | | | | | | | | an identifier table lookup, *and* copy the LangOptions (including various std::vector<std::string>s). Twice. We call this function once each time we start parsing a declaration specifier sequence, and once for each call to Sema::Diag. This reduces the compile time for a sample .c file from the linux kernel by 20%. llvm-svn: 270009
* [analyzer] Fix crash in ObjCGenericsCheckerDevin Coughlin2016-05-111-0/+273
| | | | | | | | | | | | | | | Fix a crash in the generics checker where DynamicTypePropagation tries to get the superclass of a root class. This is a spot-fix for a deeper issue where the checker makes assumptions that may not hold about subtyping between the symbolically-tracked type of a value and the compile-time types of a cast on that value. I've added a TODO to address the underlying issue. rdar://problem/26086914 llvm-svn: 269227
* [analyzer] Add tests for Objective-C class propertiesDevin Coughlin2016-05-061-0/+108
| | | | | | | | | Add basic tests to ensure the analyzer has support for class properties. This is a test-only change. rdar://problem/25256807 llvm-svn: 268773
* [analyzer] Add path note for localizability checker.Devin Coughlin2016-04-281-14/+29
| | | | | | | | | Add a path note indicating the location of the non-localized string literal in NonLocalizedStringChecker. rdar://problem/25981525 llvm-svn: 267924
* [analyzer] Let TK_PreserveContents span across the whole base region.Artem Dergachev2016-04-252-0/+66
| | | | | | | | | | | | If an address of a field is passed through a const pointer, the whole structure's base region should receive the TK_PreserveContents trait and avoid invalidation. Additionally, include a few FIXME tests shown up during testing. Differential Revision: http://reviews.llvm.org/D19057 llvm-svn: 267413
* [analyzer] Nullability: Suppress diagnostic on bind with cast.Devin Coughlin2016-04-131-3/+42
| | | | | | | | | | | | | | Update the nullability checker to allow an explicit cast to nonnull to suppress a warning on an assignment of nil to a nonnull: id _Nonnull x = (id _Nonnull)nil; // no-warning This suppression as already possible for diagnostics on returns and function/method arguments. rdar://problem/25381178 llvm-svn: 266219
* [analyzer] Nullability: Treat nil _Nonnull ivar as invariant violation.Devin Coughlin2016-04-131-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Treat a _Nonnull ivar that is nil as an invariant violation in a similar fashion to how a nil _Nonnull parameter is treated as a precondition violation. This avoids warning on defensive returns of nil on defensive internal checks, such as the following common idiom: @class InternalImplementation @interface PublicClass { InternalImplementation * _Nonnull _internal; } -(id _Nonnull)foo; @end @implementation PublicClass -(id _Nonnull)foo { if (!_internal) return nil; // no-warning return [_internal foo]; } @end rdar://problem/24485171 llvm-svn: 266157
* [analyzer] Nullability: Suppress return diagnostics in inlined functions.Devin Coughlin2016-04-121-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The nullability checker can sometimes miss detecting nullability precondition violations in inlined functions because the binding for the parameter that violated the precondition becomes dead before the return: int * _Nonnull callee(int * _Nonnull p2) { if (!p2) // p2 becomes dead here, so binding removed. return 0; // warning here because value stored in p2 is symbolic. else return p2; } int *caller(int * _Nonnull p1) { return callee(p1); } The fix, which is quite blunt, is to not warn about null returns in inlined methods/functions. This won’t lose much coverage for ObjC because the analyzer always analyzes each ObjC method at the top level in addition to inlined. It *will* lose coverage for C — but there aren’t that many codebases with C nullability annotations. rdar://problem/25615050 llvm-svn: 266109
* [analyzer] Fix assertion in ReturnVisitor for body-farm synthesized gettersDevin Coughlin2016-04-121-0/+13
| | | | | | | Don't emit a path note marking the return site if the return statement does not have a valid location. This fixes an assertion failure I introduced in r265839. llvm-svn: 266031
* [analyzer] Teach trackNullOrUndefValue about calls to property accessors.Devin Coughlin2016-04-081-0/+36
| | | | | | | | | | | Teach trackNullOrUndefValue() how to look through PseudoObjectExprs to find the underlying method call for property getters. This makes over-suppression of 'return nil' in getters consistent with the similar over-suppression for method and function calls. rdar://problem/24437252 llvm-svn: 265839
* [analyzer] Prefer accessor method in extension over category in CallEvent.Devin Coughlin2016-04-011-0/+49
| | | | | | | | | | | | | | In ObjCMethodCall:getRuntimeDefinition(), if the method is an accessor in a category, and it doesn't have a self declaration, first try to find the method in a class extension. This works around a bug in Sema where multiple accessors are synthesized for properties in class extensions that are redeclared in a category. The implicit parameters are not filled in for the method on the category, which causes a crash when trying to synthesize a getter for the property in BodyFarm. The Sema bug is tracked as rdar://problem/25481164. rdar://problem/25056531 llvm-svn: 265103
* [analyzer] Use BodyFarm-synthesized body even when actual body available.Devin Coughlin2016-03-282-1/+33
| | | | | | | | | | | | Change body autosynthesis to use the BodyFarm-synthesized body even when an actual body exists. This enables the analyzer to use the simpler, analyzer-provided body to model the behavior of the function rather than trying to understand the actual body. Further, this makes the analyzer robust against changes in headers that expose the implementations of those bodies. rdar://problem/25145950 llvm-svn: 264687
* [analyzer] Nullability: Don't warn along paths where null returned from ↵Devin Coughlin2016-03-282-2/+58
| | | | | | | | | | | | | | | | non-null. Change the nullability checker to not warn along paths where null is returned from a method with a non-null return type, even when the diagnostic for this return has been suppressed. This prevents warning from methods with non-null return types that inline methods that themselves return nil but that suppressed the diagnostic. Also change the PreconditionViolated state component to be called "InvariantViolated" because it is set when a post-condition is violated, as well. rdar://problem/25393539 llvm-svn: 264647
* [analyzer] Add CIFIlter modeling to DeallocChecker.Devin Coughlin2016-03-252-1/+94
| | | | | | | | | | | | | | | | | | | | The -dealloc method in CIFilter is highly unusual in that it will release instance variables belonging to its *subclasses* if the variable name starts with "input" or backs a property whose name starts with "input". Subclasses should not release these ivars in their own -dealloc method -- doing so could result in an over release. Before this commit, the DeallocChecker would warn about missing releases for such "input" properties -- which could cause users of the analyzer to add over releases to silence the warning. To avoid this, DeallocChecker now treats CIFilter "input-prefixed" ivars as MustNotReleaseDirectly and so will not require a release. Further, it will now warn when such an ivar is directly released in -dealloc. rdar://problem/25364901 llvm-svn: 264463
* [analyzer] Fix missed leak from MSVC specific allocation functionsAnna Zaks2016-03-081-0/+76
| | | | | | | | | | | | Add the wide character strdup variants (wcsdup, _wcsdup) and the MSVC version of alloca (_alloca) and other differently named function used by the Malloc checker. A patch by Alexander Riccio! Differential Revision: http://reviews.llvm.org/D17688 llvm-svn: 262894
* P0188R1: add support for standard [[fallthrough]] attribute. This is almostRichard Smith2016-03-081-2/+1
| | | | | | | | | | | | | | exactly the same as clang's existing [[clang::fallthrough]] attribute, which has been updated to have the same semantics. The one significant difference is that [[fallthrough]] is ill-formed if it's not used immediately before a switch label (even when -Wimplicit-fallthrough is disabled). To support that, we now build a CFG of any function that uses a '[[fallthrough]];' statement to check. In passing, fix some bugs with our support for statement attributes -- in particular, diagnose their use on declarations, rather than asserting. llvm-svn: 262881
* [analyzer] Nullability: add option to not report on calls to system headers.Devin Coughlin2016-03-053-50/+91
| | | | | | | | | | | | | | Add an -analyzer-config 'nullability:NoDiagnoseCallsToSystemHeaders' option to the nullability checker. When enabled, this option causes the analyzer to not report about passing null/nullable values to functions and methods declared in system headers. This option is motivated by the observation that large projects may have many nullability warnings. These projects may find warnings about nullability annotations that they have explicitly added themselves higher priority to fix than warnings on calls to system libraries. llvm-svn: 262763
* [analyzer] Add diagnostic in ObjCDeallocChecker for use of -dealloc instead ↵Devin Coughlin2016-03-041-0/+21
| | | | | | | | | | | | | | | | | | of -release. In dealloc methods, the analyzer now warns when -dealloc is called directly on a synthesized retain/copy ivar instead of -release. This is intended to find mistakes of the form: - (void)dealloc { [_ivar dealloc]; // Mistaken call to -dealloc instead of -release [super dealloc]; } rdar://problem/16227989 llvm-svn: 262729
* [analyzer] ObjCDeallocChecker: Only check for nil-out when type is retainable.Devin Coughlin2016-03-031-0/+19
| | | | | | This fixes a crash when setting a property of struct type in -dealloc. llvm-svn: 262659
* [analyzer] Move ObjCSuperDeallocChecker out of the alpha package.Devin Coughlin2016-03-021-1/+1
| | | | | | | | It will now be on by default on Darwin. rdar://problem/6953275 llvm-svn: 262526
* [analyzer] Move ObjCDeallocChecker out of the alpha package.Devin Coughlin2016-03-024-7/+7
| | | | | | | | It will now be on by default on Darwin. rdar://problem/6927496 llvm-svn: 262524
* [analyzer] Fix capitalization in ObjCSuperDeallocChecker diagnostic.Devin Coughlin2016-03-021-10/+10
| | | | llvm-svn: 262520
* [analyzer] Update CheckObjCDealloc diagnostic for missing -dealloc.Devin Coughlin2016-03-011-6/+32
| | | | | | | Update the diagnostic for classes missing -dealloc to mention an instance variable that needs to be released. llvm-svn: 262277
* [analyzer] Teach CheckObjCDealloc about Block_release().Devin Coughlin2016-02-292-0/+9
| | | | | | It now treats Block_release(b) as a release in addition to [b release]. llvm-svn: 262272
OpenPOWER on IntegriCloud