summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Better detect when C++ object was constructed into existing region.Devin Coughlin2015-12-171-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | When the analyzer evaluates a CXXConstructExpr, it looks ahead in the CFG for the current block to detect what region the object should be constructed into. If the constructor was directly constructed into a local variable or field region then there is no need to explicitly bind the constructed value to the local or field when analyzing the DeclStmt or CXXCtorInitializer that called the constructor. Unfortunately, there were situations in which the CXXConstructExpr was constructed into a temporary region but when evaluating the corresponding DeclStmt or CXXCtorInitializer the analyzer assumed the object was constructed into the local or field. This led to spurious warnings about uninitialized values (PR25777). To avoid these false positives, this commit factors out the logic for determining when a CXXConstructExpr will be directly constructed into existing storage, adds the inverse logic to detect when the corresponding later bind can be safely skipped, and adds assertions to make sure these two checks are in sync. rdar://problem/21947725 llvm-svn: 255859
* clang/test/Analysis/padding_c.c: Suppress a test incompatible to i686-linux.NAKAMURA Takumi2015-12-151-7/+0
| | | | | | | | error: 'warning' diagnostics expected but not seen: File clang/test/Analysis/padding_c.c Line 194 (directive at clang/test/Analysis/padding_c.c:193): Excessive padding in 'struct DefaultAttrAlign' 1 error generated. llvm-svn: 255636
* [PATCH] Adding checker to detect excess padding in recordsBen Craig2015-12-143-0/+630
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this checker is to generate a report for any class / structure that could reduce its padding by reordering the fields. This results in a very noisy checker. To reduce the noise, this checker will currently only warn when the number of bytes over "optimal" is more than 24. This value is configurable with -analyzer-config performance.Padding:AllowedPad=N. Small values of AllowedPad have the potential to generate hundreds of reports, and gigabytes of HTML reports. The checker searches for padding violations in two main ways. First, it goes record by record. A report is generated if the fields could be reordered in a way that reduces the padding by more than AllowedPad bytes. Second, the checker will generate a report if an array will cause more than AllowedPad padding bytes to be generated. The record checker currently skips many ABI specific cases. Classes with base classes are skipped because base class tail padding is ABI specific. Bitfields are just plain hard, and duplicating that code seems like a bad idea. VLAs are both uncommon and non-trivial to fix. The array checker isn't very thorough right now. It only checks to see if the element type's fields could be reordered, and it doesn't recursively check to see if any of the fields' fields could be reordered. At some point in the future, it would be nice if "arrays" could also look at array new usages and malloc patterns that appear to be creating arrays. llvm-svn: 255545
* [analyzer] Fix symbolic element index lifetime.Artem Dergachev2015-12-102-0/+103
| | | | | | | | | | | | SymbolReaper was destroying the symbol too early when it was referenced only from an index SVal of a live ElementRegion. In order to test certain aspects of this patch, extend the debug.ExprInspection checker to allow testing SymbolReaper in a direct manner. Differential Revision: http://reviews.llvm.org/D12726 llvm-svn: 255236
* [analyzer] Fix crash when lambda captures a variable-length array.Devin Coughlin2015-12-071-0/+13
| | | | | | | | | | | | When a C++ lambda captures a variable-length array, it creates a capture field to store the size of the array. The initialization expression for this capture is null, which led the analyzer to crash when initializing the field. To avoid this, use the size expression from the VLA type to determine the initialization value. rdar://problem/23748072 llvm-svn: 254962
* [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).Devin Coughlin2015-12-051-1/+14
| | | | | | | | | | This commit prevents MemRegion::getAsOffset() from crashing when the analyzed program casts a symbolic region of a non-record type to some derived type and then attempts to access a field of the base type. rdar://problem/23458069 llvm-svn: 254806
* [analyzer] Improve modelling of nullptr_t in the analyzer. Fix PR25414.Gabor Horvath2015-12-041-1/+40
| | | | | | Differential Revision: http://reviews.llvm.org/D15007 llvm-svn: 254718
* [analyzer] Support inlining lambda-converted blocks.Devin Coughlin2015-12-041-3/+47
| | | | | | | | | clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
* [analyzer] Suppress stack address escape on CK_CopyAndAutoreleaseBlockObject.Devin Coughlin2015-12-031-4/+4
| | | | | | | | | | Don't warn about addresses of stack-allocated blocks escaping if the block region was cast with CK_CopyAndAutoreleaseBlockObject. These casts, which are introduced in the implicit conversion operator for lambda-to-block conversions, cause the block to be copied to the heap -- so the warning is spurious. llvm-svn: 254639
* [analyzer] Fix IssueHash generation.Gabor Horvath2015-12-012-5/+5
| | | | | | | | Differential Revision: http://reviews.llvm.org/D14919 Original patch by: Gyorgy Orban! llvm-svn: 254394
* [analyzer] Add tests for generalized lambda capture (C++14). NFC.Devin Coughlin2015-11-261-0/+50
| | | | | | | | Add tests demonstrating that the analyzer supports generalized lambda capture. This support falls out naturally from the work Gábor Horváth did adding C++11 lambdas to the analyzer. llvm-svn: 254114
* [analyzer] Include block capture copy expressions in the CFG.Devin Coughlin2015-11-252-1/+116
| | | | | | | | | | | This prevents spurious dead store warnings when a C++ lambda is casted to a block. I've also added several tests documenting our still-incomplete support for lambda-to-block casts. rdar://problem/22236293 llvm-svn: 254107
* [analyzer] Pass value expression for inlined defensive checks when binding ↵Devin Coughlin2015-11-241-1/+14
| | | | | | | | | | | | | | | | null to nonnull. The nullability checker was not suppressing false positives resulting from inlined defensive checks when null was bound to a nonnull variable because it was passing the entire bind statement rather than the value expression to trackNullOrUndefValue(). This commit changes that checker to synactically match on the bind statement to extract the value expression so it can be passed to trackNullOrUndefValue(). rdar://problem/23575439 llvm-svn: 254007
* [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ ↵Devin Coughlin2015-11-201-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | lambdas as escaped. The analyzer currently reports dead store false positives when a local variable is captured by reference in a C++ lambda. For example: int local = 0; auto lambda = [&local]() { local++; }; local = 7; // False Positive: Value stored to 'local' is never read lambda(); In this case, the assignment setting `local` to 7 is not a dead store because the called lambda will later read that assigned value. This commit silences this source of false positives by treating locals captured by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker deals with locals whose address is taken. rdar://problem/22165179 llvm-svn: 253630
* [analyzer] Improve modeling of static initializers.Anna Zaks2015-11-191-1/+8
| | | | | | | | | | | | Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem. The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov! Differential Revision: http://reviews.llvm.org/D14652 llvm-svn: 253532
* [analyzer] Skip checking blocks in dependent contexts.Devin Coughlin2015-11-181-2/+16
| | | | | | | | | | | Since we don't check functions in dependent contexts, we should skip blocks in those contexts as well. This avoids an assertion failure when the DeadStoresChecker attempts to evaluate an array subscript expression with a dependent name type. rdar://problem/23564220 llvm-svn: 253516
* [analyzer] Handle calling ObjC super method from inside C++ lambda.Devin Coughlin2015-11-151-0/+46
| | | | | | | | | | When calling a ObjC method on super from inside a C++ lambda, look at the captures to find "self". This mirrors how the analyzer handles calling super in an ObjC block and fixes an assertion failure. rdar://problem/23550077 llvm-svn: 253176
* [analyzer] Refer to capture field to determine if capture is reference.Devin Coughlin2015-11-151-0/+72
| | | | | | | | | | | | | The analyzer incorrectly treats captures as references if either the original captured variable is a reference or the variable is captured by reference. This causes the analyzer to crash when capturing a reference type by copy (PR24914). Fix this by refering solely to the capture field to determine when a DeclRefExpr for a lambda capture should be treated as a reference type. https://llvm.org/bugs/show_bug.cgi?id=24914 rdar://problem/23524412 llvm-svn: 253157
* CFG: Delay creating Dtors for CompoundStmts which end in ReturnStmtMatthias Gehre2015-11-141-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: VisitReturnStmt would create a new block with including Dtors, so the Dtors created in VisitCompoundStmts would be in an unreachable block. Example: struct S { ~S(); }; void f() { S s; return; } void g() { S s; } Before this patch, f has one additional unreachable block containing just the destructor of S. With this patch, both f and g have the same blocks. Reviewers: krememek Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D13973 llvm-svn: 253107
* [static analyzer] Don't flag nil storage into NSMutableDictionary.Anna Zaks2015-11-111-2/+1
| | | | | | This is now allowed and has the behavior of removing the mapping. llvm-svn: 252679
* [analyzer] Fix assertion failure invalidating on const member function calls ↵Devin Coughlin2015-11-091-0/+19
| | | | | | | | (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
* Fix __builtin_signbit for ppcf128 typePetar Jovanovic2015-11-061-0/+43
| | | | | | | | | | | Function__builtin_signbit returns wrong value for type ppcf128 on big endian machines. This patch fixes how value is generated in that case. Patch by Aleksandar Beserminji. Differential Revision: http://reviews.llvm.org/D14149 llvm-svn: 252307
* [analyzer] Add VforkChecker to find unsafe code in vforked process.Yury Gribov2015-11-062-0/+124
| | | | | | | | | | | | This checker looks for unsafe constructs in vforked process: function calls (excluding whitelist), memory write and returns. This was originally motivated by a vfork-related bug in xtables package. Patch by Yury Gribov. Differential revision: http://reviews.llvm.org/D14014 llvm-svn: 252285
* [analyzer] Update RegionStoreManager::getBinding to handle BlockDataRegionsDevin Coughlin2015-11-051-4483/+4849
| | | | | | | | | | | | Update RegionStoreManager::getBinding() to return UnknownVal when trying to get the binding for a BlockDataRegion. Previously, getBinding() would try to cast the BlockDataRegion to a TypedValueRegion and crash. This happened when a block was passed as a parameter to an inlined function for which StackHintGeneratorForSymbol::getMessage() tried to generate a stack hint message. rdar://problem/21291971 llvm-svn: 252185
* [analyzer] Add 'optin' checker package and move localizability checkers into it.Devin Coughlin2015-11-042-2/+2
| | | | | | | | | | | | | | | | | | | | | | This commit creates a new 'optin' top-level checker package and moves several of the localizability checkers into it. This package is for checkers that are not alpha and that would normally be on by default but where the driver does not have enough information to determine when they are applicable. The localizability checkers fit this criterion because the driver cannot determine whether a project is localized or not -- this is best determined at the IDE or build-system level. This new package is *not* intended for checkers that are too noisy to be on by default. The hierarchy under 'optin' mirrors that in 'alpha': checkers under 'optin' should be organized in the hierarchy they would have had if they were truly top level (e.g., optin.osx.cocoa.MyOptInChecker). Differential Revision: http://reviews.llvm.org/D14303 llvm-svn: 252080
* [analyzer] Move the ObjCGenericsChecker out of the alpha package.Devin Coughlin2015-11-032-3/+3
| | | | | | | It is now in the osx.cocoa package and so will be on by default for Apple toolchains. llvm-svn: 251966
* Reapply r251621 "[Analyzer] Widening loops which do not exit"Sean Eveson2015-10-303-2/+194
| | | | | | It was not the cause of the build bot failure. llvm-svn: 251702
* Revert r251621 "[Analyzer] Widening loops which do not exit" (bot failure)Sean Eveson2015-10-303-194/+2
| | | | | | | | Seems to be causing clang-cmake-mips build bot to fail (timeout) http://lab.llvm.org:8011/builders/clang-cmake-mips/builds/10299 llvm-svn: 251697
* [Analyzer] Widening loops which do not exitSean Eveson2015-10-293-2/+194
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Dear All, We have been looking at the following problem, where any code after the constant bound loop is not analyzed because of the limit on how many times the same block is visited, as described in bugzillas #7638 and #23438. This problem is of interest to us because we have identified significant bugs that the checkers are not locating. We have been discussing a solution involving ranges as a longer term project, but I would like to propose a patch to improve the current implementation. Example issue: ``` for (int i = 0; i < 1000; ++i) {...something...} int *p = 0; *p = 0xDEADBEEF; ``` The proposal is to go through the first and last iterations of the loop. The patch creates an exploded node for the approximate last iteration of constant bound loops, before the max loop limit / block visit limit is reached. It does this by identifying the variable in the loop condition and finding the value which is “one away” from the loop being false. For example, if the condition is (x < 10), then an exploded node is created where the value of x is 9. Evaluating the loop body with x = 9 will then result in the analysis continuing after the loop, providing x is incremented. The patch passes all the tests, with some modifications to coverage.c, in order to make the ‘function_which_gives_up’ continue to give up, since the changes allowed the analysis to progress past the loop. This patch does introduce possible false positives, as a result of not knowing the state of variables which might be modified in the loop. I believe that, as a user, I would rather have false positives after loops than do no analysis at all. I understand this may not be the common opinion and am interested in hearing your views. There are also issues regarding break statements, which are not considered. A more advanced implementation of this approach might be able to consider other conditions in the loop, which would allow paths leading to breaks to be analyzed. Lastly, I have performed a study on large code bases and I think there is little benefit in having “max-loop” default to 4 with the patch. For variable bound loops this tends to result in duplicated analysis after the loop, and it makes little difference to any constant bound loop which will do more than a few iterations. It might be beneficial to lower the default to 2, especially for the shallow analysis setting. Please let me know your opinions on this approach to processing constant bound loops and the patch itself. Regards, Sean Eveson SN Systems - Sony Computer Entertainment Group Reviewers: jordan_rose, krememek, xazax.hun, zaks.anna, dcoughlin Subscribers: krememek, xazax.hun, cfe-commits Differential Revision: http://reviews.llvm.org/D12358 llvm-svn: 251621
* [analyzer] Assume escape is possible through system functions taking void*Anna Zaks2015-10-272-0/+23
| | | | | | | | | | | | | | | | | | The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
* [analyzer] Fix lambdas that are capturing constants.Gabor Horvath2015-10-271-0/+15
| | | | llvm-svn: 251407
* [analyzer] Fix another crash when analyzing lambda functions.Gabor Horvath2015-10-271-0/+6
| | | | llvm-svn: 251404
* [analyzer] Added a missing test case for r251289.Gabor Horvath2015-10-261-0/+13
| | | | llvm-svn: 251313
* Attempt to fix build bot test failures.Gabor Horvath2015-10-221-1/+1
| | | | llvm-svn: 251014
* [analyzer] Bug identificationGabor Horvath2015-10-2232-8410/+11555
| | | | | | | | | | | | | | | | This patch adds hashes to the plist and html output to be able to identfy bugs for suppressing false positives or diff results against a baseline. This hash aims to be resilient for code evolution and is usable to identify bugs in two different snapshots of the same software. One missing piece however is a permanent unique identifier of the checker that produces the warning. Once that issue is resolved, the hashes generated are going to change. Until that point this feature is marked experimental, but it is suitable for early adoption. Differential Revision: http://reviews.llvm.org/D10305 Original patch by: Bence Babati! llvm-svn: 251011
* [analyzer] Don’t invalidate CXXThis when conservatively evaluating const ↵Devin Coughlin2015-10-131-0/+230
| | | | | | | | | | | | methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
* Update tests touched by r249656David Majnemer2015-10-083-3/+3
| | | | | | | | | These test updates almost exclusively around the change in behavior around enum: enums without a definition are considered incomplete except when targeting MSVC ABIs. Since these tests are interested in the 'incomplete-enum' behavior, restrict them to %itanium_abi_triple. llvm-svn: 249660
* [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire ↵Devin Coughlin2015-09-241-0/+916
| | | | | | | | | | | | | | | | | | | | region. Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size array fields. With this change, instead of invalidating the entire containing region the analyzer now invalidates only offsets for the array itself when it can show that the memcpy stays within the bounds of the array. This addresses false positive memory leak warnings of the kind reported by krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954 (This is the second attempt, now with assertion failures resolved.) A patch by Pierre Gousseau! Differential Revision: http://reviews.llvm.org/D12571 llvm-svn: 248516
* clang/test/Analysis/malloc-overflow2.c: Appease 32-bit targets.NAKAMURA Takumi2015-09-241-1/+1
| | | | | | size_t is not unsigned long for targeting i686 (and Windows x64). llvm-svn: 248458
* [analyzer] Discard malloc-overflow bug-report when a known size is malloc'ed.Devin Coughlin2015-09-232-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch ignores malloc-overflow bug in two cases: Case1: x = a/b; where n < b malloc (x*n); Then x*n will not overflow. Case2: x = a; // when 'a' is a known value. malloc (x*n); Also replaced isa with dyn_cast. Reject multiplication by zero cases in MallocOverflowSecurityChecker Currently MallocOverflowSecurityChecker does not catch cases like: malloc(n * 0 * sizeof(int)); This patch rejects such cases. Two test cases added. malloc-overflow2.c has an example inspired from a code in linux kernel where the current checker flags a warning while it should not. A patch by Aditya Kumar! Differential Revision: http://reviews.llvm.org/D9924 llvm-svn: 248446
* [analyzer] Improve localizability checks for iOS / OS X.Devin Coughlin2015-09-232-10/+154
| | | | | | | | | | | | | | | | | | | | Various improvements to the localization checker: * Adjusted copy to be consistent with diagnostic text in other Apple API checkers. * Added in ~150 UIKit / AppKit methods that require localized strings in UnlocalizedStringsChecker. * UnlocalizedStringChecker now checks for UI methods up the class hierarchy and UI methods that conform for a certain Objective-C protocol. * Added in alpha version of PluralMisuseChecker and some regression tests. False positives are still not ideal. (This is the second attempt, with the memory issues on Linux resolved.) A patch by Kulpreet Chilana! Differential Revision: http://reviews.llvm.org/D12417 llvm-svn: 248432
* Revert "[analyzer] Improve localizability checks for iOS / OS X."Devin Coughlin2015-09-232-154/+10
| | | | | | This reverts commit r248350. The pluralization checks are failing on some bots. llvm-svn: 248351
* [analyzer] Improve localizability checks for iOS / OS X.Devin Coughlin2015-09-222-10/+154
| | | | | | | | | | | | | | | | | | Various improvements to the localization checker: * Adjusted copy to be consistent with diagnostic text in other Apple API checkers. * Added in ~150 UIKit / AppKit methods that require localized strings in UnlocalizedStringsChecker. * UnlocalizedStringChecker now checks for UI methods up the class hierarchy and UI methods that conform for a certain Objective-C protocol. * Added in alpha version of PluralMisuseChecker and some regression tests. False positives are still not ideal. A patch by Kulpreet Chilana! Differential Revision: http://reviews.llvm.org/D12417 llvm-svn: 248350
* [analyzer] Make realloc(ptr, 0) handling equivalent to malloc(0).Devin Coughlin2015-09-221-3/+31
| | | | | | | | | | | | | | | | | | Currently realloc(ptr, 0) is treated as free() which seems to be not correct. C standard (N1570) establishes equivalent behavior for malloc(0) and realloc(ptr, 0): "7.22.3 Memory management functions calloc, malloc, realloc: If the size of the space requested is zero, the behavior is implementation-defined: either a null pointer is returned, or the behavior is as if the size were some nonzero value, except that the returned pointer shall not be used to access an object." The patch equalizes the processing of malloc(0) and realloc(ptr,0). The patch also enables unix.Malloc checker to detect references to zero-allocated memory returned by realloc(ptr,0) ("Use of zero-allocated memory" warning). A patch by Антон Ярцев! Differential Revision: http://reviews.llvm.org/D9040 llvm-svn: 248336
* [analyzer] Create one state for a range switch case instead of multiple.Devin Coughlin2015-09-221-0/+220
| | | | | | | | | | | | | This fixes PR16833, in which the analyzer was using large amounts of memory for switch statements with large case ranges. rdar://problem/14685772 A patch by Aleksei Sidorin! Differential Revision: http://reviews.llvm.org/D5102 llvm-svn: 248318
* Analyzer: Teach analyzer how to handle TypeTraitExprIsmail Pazarbasi2015-09-221-1/+36
| | | | | | | | | | | | | | | | | | | | Summary: `TypeTraitExpr`s are not supported by the ExprEngine today. Analyzer creates a sink, and aborts the block. Therefore, certain bugs that involve type traits intrinsics cannot be detected (see PR24710). This patch creates boolean `SVal`s for `TypeTraitExpr`s, which are evaluated by the compiler. Test within the patch is a summary of PR24710. Reviewers: zaks.anna, dcoughlin, krememek Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D12482 llvm-svn: 248314
* [Static Analyzer] Fixed a false positive case in DynamicTypeChecker when ↵Gabor Horvath2015-09-181-0/+10
| | | | | | dealing with forward declarations. llvm-svn: 248065
* Analyzer: Fix a crasher in UbigraphVizIsmail Pazarbasi2015-09-181-0/+7
| | | | | | | | | | | | | | | Summary: Name `Out` refers to the parameter. It is moved into the member `Out` in ctor-init. Dereferencing null pointer will crash clang, if user passes '-analyzer-viz-egraph-ubigraph' argument. Reviewers: zaks.anna, krememek Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D12119 llvm-svn: 248050
* [Static Analyzer] General type checker based on dynamic type information.Gabor Horvath2015-09-182-219/+429
| | | | | | Differential Revision: http://reviews.llvm.org/D12973 llvm-svn: 248041
* [analyzer] A fix for substraction of an integer from a pointer.Gabor Horvath2015-09-181-0/+17
| | | | | | | | Patch by Artem Dergachev! Differential Revision: http://reviews.llvm.org/D12725 llvm-svn: 248021
OpenPOWER on IntegriCloud