summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
* Add basic support for pointer arithmetic inTed Kremenek2010-12-241-7/+3
| | | | | | | | SimpleSValBuilder. This clears up some false positives emitted by ArrayBoundCheckerV2 due to the lack of support for pointer arithmetic. llvm-svn: 122546
* It's amazing what you find when you actuallyTed Kremenek2010-12-231-7/+27
| | | | | | | | | | | set the RUN line correctly in a test file! Mark a bunch of tests for ArrayBoundCheckerV2 as FIXME's, as our current lack of pointer arithmetic handling causes these to be all false positives/negatives. llvm-svn: 122471
* Add WIP prototype of a new buffer overflowTed Kremenek2010-12-231-0/+132
| | | | | | | checker based on using raw (symbolic) byte offsets from a base region. llvm-svn: 122469
* If the unary operator is prefix and an lvalue (in C++), bindZhongxing Xu2010-12-221-1/+0
| | | | | | the location (l-value) to it. llvm-svn: 122396
* After inlining the CXXConstructExpr, bind the temporary object region to it.Zhongxing Xu2010-12-221-1/+0
| | | | | | | | | | | This change is necessary when the variable is a const reference and we need the l-value of the construct expr. After that, when binding the variable, recover the lazy compound value when the variable is not a reference. In Environment, use the value of a no-op cast expression when it has one. Otherwise, blast-through it. llvm-svn: 122388
* If the initializer is an rvalue and the variable is a const reference,Zhongxing Xu2010-12-191-1/+1
| | | | | | create a temporary object for it. llvm-svn: 122161
* Fix assertion failure in cocoa::deriveNamingConvention()Ted Kremenek2010-12-171-0/+4
| | | | | | when the selector is the string 'mutable'. llvm-svn: 122046
* Revise Cocoa conventions detection: 'copy' and 'mutableCopy'Ted Kremenek2010-12-172-6/+10
| | | | | | | | only indicates the create rule if it starts at the beginning of the method name, not within the method name. llvm-svn: 122036
* Do lvalue-to-rvalue conversions on the LHS of a shift operator.John McCall2010-12-162-2/+0
| | | | | | Fixes rdar://problem/8776586. llvm-svn: 121992
* Start migration of static analyzer to using theTed Kremenek2010-12-165-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implicit lvalue-to-rvalue casts that John McCall recently introduced. This causes a whole bunch of logic in the analyzer for handling lvalues to vanish. It does, however, raise a few issues in the analyzer w.r.t to modeling various constructs (e.g., field accesses to compound literals). The .c/.m analysis test cases that fail are due to a missing lvalue-to-rvalue cast that will get introduced into the AST. The .cpp failures were more than I could investigate in one go, and the patch was already getting huge. I have XFAILED some of these tests, and they should obviously be further investigated. Some highlights of this patch include: - CFG no longer requires an lvalue bit for CFGElements - StackFrameContext doesn't need an 'asLValue' flag - The "VisitLValue" path from GRExprEngine has been eliminated. Besides the test case failures (XFAILed), there are surely other bugs that are fallout from this change. llvm-svn: 121960
* Add test case for r120795.Ted Kremenek2010-12-031-0/+24
| | | | llvm-svn: 120796
* Follow through references to catch returned stack addresses, local blocks, ↵Argyrios Kyrtzidis2010-11-301-0/+86
| | | | | | | | | | | | label addresses or references to temporaries, e.g: const int& g2() { int s1; int &s2 = s1; // expected-note {{binding reference variable 's2' here}} return s2; // expected-warning {{reference to stack memory associated with local variable 's1' returned}} } llvm-svn: 120483
* Revert r120331 since it causes spurious warnings and a possible assertion ↵Argyrios Kyrtzidis2010-11-291-9/+0
| | | | | | hit when self-host. llvm-svn: 120351
* Emit warnings if we are returning a reference to a local temporary.Argyrios Kyrtzidis2010-11-291-0/+9
| | | | | | The issue was brought to our attention by Matthieu Monrocq. llvm-svn: 120331
* Regionstore: support derived-to-base cast by creating a CXXBaseObjectRegion.Zhongxing Xu2010-11-261-0/+15
| | | | llvm-svn: 120173
* handle CXXFunctionalCastExpr in visitLValue and Environment.Zhongxing Xu2010-11-251-0/+11
| | | | llvm-svn: 120143
* When getting CXXThisRegion from CXXMethodDecl, use the qualifiers. This is Zhongxing Xu2010-11-241-1/+1
| | | | | | | | | | | to be consistent with the type of 'this' expr in the method. 此行及以下内容将会被忽略-- M test/Analysis/method-call.cpp M include/clang/Checker/PathSensitive/GRExprEngine.h M lib/Checker/GRCXXExprEngine.cpp llvm-svn: 120094
* Fix PR8419. Reviewed by kremenek and xuzhongxing.Zhanyong Wan2010-11-221-0/+19
| | | | llvm-svn: 119960
* Handle CFGAutomaticObjDtor. Zhongxing Xu2010-11-201-0/+13
| | | | llvm-svn: 119897
* Static analyzer: Catch calls to malloc() withTed Kremenek2010-11-161-0/+17
| | | | | | | | allocation sizes of 0 bytes. Fixes PR 2899. llvm-svn: 119364
* Handle member initializer in C++ ctor. Zhongxing Xu2010-11-161-0/+14
| | | | | | | | | - Add a new Kind of ProgramPoint: PostInitializer. - Still use GRStmtNodeBuilder. But special handling PostInitializer in GRStmtNodeBuilder::GenerateAutoTransition(). - Someday we should clean up the interface of GRStmtNodeBuilder. llvm-svn: 119335
* Remove invalid assertion from CFG builder. When building the CFG pieces for ↵Ted Kremenek2010-11-151-0/+9
| | | | | | | | | a ternary '?' expression, it is possible for the confluence block to only have a single predecessor due to calls to 'noreturn' functions. Fixes assertion failure reported in PR 8619. llvm-svn: 119284
* Relax assertion in SValuator so that we don't crash when analyzing a call ↵Ted Kremenek2010-11-151-0/+10
| | | | | | | | | via a function pointer that casts the return value to something completely different. While we need better reasoning here, we should definately not crash. llvm-svn: 119177
* Revert r118991.Zhongxing Xu2010-11-141-3/+12
| | | | | | | | | Elidable CXXConstructExpr should inhibit calling destructor for temporary that is copied, not the one created. This is because eliding copy constructor means that the object that was to be copied will be constructed directly in memory the copy would be constructed in. llvm-svn: 119044
* Do not add implicit dtors for CXXBindTemporaryExpr with elidable Zhongxing Xu2010-11-131-12/+3
| | | | | | CXXConstructExpr. llvm-svn: 118991
* RegionStore/BasicStore: do not return UndefinedVal for accesses to concrete ↵Ted Kremenek2010-11-111-0/+14
| | | | | | | | | | addresses; instead return UnknownVal. This leads it up to checkers (e.g., DereferenceChecker) to guard against illegal accesses (e.g., null dereferences). Fixes PR 5272 and <rdar://problem/6839683>. llvm-svn: 118852
* Teach AttrNonNullChecker about transparent unions. Fixes crash reported in ↵Ted Kremenek2010-11-091-0/+14
| | | | | | <rdar://problem/8642434>. llvm-svn: 118473
* fix test case.Zhongxing Xu2010-11-031-473/+457
| | | | llvm-svn: 118166
* Added generating destructors for temporary objects. Two cases I know of, ↵Marcin Swiderski2010-11-031-0/+581
| | | | | | | | | that are not handled properly: 1. For statement: const C& c = C(0) ?: C(1) destructors generated for condition will not differ from those generated for case without prolonged lifetime of temporary, 2. There will be no destructor for constant reference member bound to temporary at the exit from constructor. llvm-svn: 118158
* Make my test case test what it meant toDouglas Gregor2010-11-011-1/+1
| | | | llvm-svn: 117974
* Teach the CStringChecker and PthreadLockChecker about non-identifierDouglas Gregor2010-11-011-0/+16
| | | | | | declaration names, from Jim Goodnow II! llvm-svn: 117970
* Now initializer of C++ record type is visited as block-level expr. Zhongxing Xu2010-11-011-1/+1
| | | | | | | Let the destination of AggExprVisitor be an explicit MemRegion. Reenable the test case. llvm-svn: 117908
* Make all CXXConstructExpr's block-level expressions. This is required by Zhongxing Xu2010-11-013-666/+721
| | | | | | method inlining. Temporarily fail a test case. llvm-svn: 117907
* Make Clang static analyzer skip function template definitions. This fixes ↵Zhanyong Wan2010-10-311-0/+47
| | | | | | Clang PR 8426, 8427, & 8433. Reviewed by Ted Kremenek and Doug Gregor. llvm-svn: 117853
* Don't flag idempotent '+' or '-' warnings for pointer arithmetic (typically ↵Ted Kremenek2010-10-291-0/+10
| | | | | | | | false positives). Fixes <rdar://problem/8601243>. llvm-svn: 117635
* Add test case for <rdar://problem/8356342>.Ted Kremenek2010-10-281-0/+19
| | | | llvm-svn: 117525
* Don't warn about unamed bitfield ivars in the ObjCUnusedIvarsChecker. Fixes ↵Ted Kremenek2010-10-281-1/+13
| | | | | | <rdar://problem/8481311>. llvm-svn: 117521
* If visiting RHS causes us to finish 'Block', e.g. the RHS is a StmtExprZhongxing Xu2010-10-271-0/+6
| | | | | | | | | containing a DoStmt, and the LHS doesn't create a new block, then we should return RBlock. Otherwise we'll incorrectly return NULL. Also relax an assertion in VisitWhileStmt(). Reset 'Block' when it is finished. llvm-svn: 117436
* Fix lazy symbolication bug in RegionStore involving fields of global ↵Ted Kremenek2010-10-261-0/+20
| | | | | | | | | | | variables. When invalidated, the entire globals memory space gets assigned a symbolic value, but that value was not being used for lazy symbolication of fields of globals. This could result in cases where bogus null dereferences were being reported. Fixes PR 8440. llvm-svn: 117336
* Tweak null dereference checker to give better diagnostics for null ↵Ted Kremenek2010-10-262-8/+8
| | | | | | dereferences resulting from array accesses. llvm-svn: 117334
* Add check for UnknownVals for mutexes in ObjCAtSyncChecker. Fixes crash ↵Ted Kremenek2010-10-251-0/+10
| | | | | | reported in PR 8458. llvm-svn: 117300
* Added generation of destructors for member constant size arrays.Marcin Swiderski2010-10-251-0/+19
| | | | | | There's only one destructor call generated for each not empty array (at least for now this should be enough). llvm-svn: 117252
* Added generation of destructors for constant size arrays.Marcin Swiderski2010-10-251-0/+17
| | | | | | There's only one destructor call generated for each not empty array (at least for now this should be enough). llvm-svn: 117251
* Warn if a variable marked with the "unused" attribute is used. Patch by ↵Anders Carlsson2010-10-221-1/+1
| | | | | | Darin Adler! llvm-svn: 117184
* Fix a horrible bug in all dataflow analyses that use CFGRecStmtVisitor ↵Ted Kremenek2010-10-221-0/+18
| | | | | | | | | (including live variables analysis). We shouldn't recurse into CompoundStmts since they are already inlined in the CFG. This could result in bogus dead stores warnings (among other things). llvm-svn: 117162
* Tweak the ObjCAtSyncChecker to assume that a mutex is non-nil after checking ↵Ted Kremenek2010-10-211-0/+14
| | | | | | | | | that it is nil. Otherwise we can get false paths where a second @synchronized using the mutex can have a bogus warning. Fixes <rdar://problem/8578650>. llvm-svn: 117016
* "Fix" bogus idempotent operations warning due to loop unrolling not ↵Ted Kremenek2010-10-181-0/+29
| | | | | | | | | | unrolling enough loops to show that an invariant doesn't hold. This fix is to increase the loop unrolling count to 4, which experiments show doesn't typically impact analysis time. The real fix is to modify the IdempotentOperationsChecker to suppress warnings where an analysis point could be preceded by a point where we gave up due to loop unrolling. llvm-svn: 116769
* Tweak retain/release checker diagnostics to specify a leak occurs because an ↵Ted Kremenek2010-10-151-2/+2
| | | | | | | | object is not referenced later in the path, not that it isn't referenced later in the code. Fixes <rdar://problem/8527839>. llvm-svn: 116636
* Add experimental chroot check which checks improper use of chroot(). Patch by Zhongxing Xu2010-10-101-0/+24
| | | | | | Lei Zhang. llvm-svn: 116163
* UnreachableCodeChecker cleanup and improvementsTom Care2010-10-061-3/+23
| | | | | | | | | | - Fixed some iterator style issues - Don't process blocks that have been visited already - Fixed a case where a unreachable block cycle was not reported - Minor test case changes - Added one test case from flow-sensitive version of the check. More coming. llvm-svn: 115861
OpenPOWER on IntegriCloud