summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
* PR16054: Slight strengthening for -Wsometimes-uninitialized: if we use aRichard Smith2013-09-121-8/+50
| | | | | | | | | | | variable uninitialized every time we reach its (reachable) declaration, or every time we call the surrounding function, promote the warning from -Wmaybe-uninitialized to -Wsometimes-uninitialized. This is still slightly weaker than desired: we should, in general, warn if a use is uninitialized the first time it is evaluated. llvm-svn: 190623
* [analyzer] Handle zeroing constructors for fields of structs with empty bases.Jordan Rose2013-09-111-0/+24
| | | | | | | | | | | | | | | | | | | RegionStore tries to protect against accidentally initializing the same region twice, but it doesn't take subregions into account very well. If the outer region being initialized is a struct with an empty base class, the offset of the first field in the struct will be 0. When we initialize the base class, we may invalidate the contents of the struct by providing a default value of Unknown (or some new symbol). We then go to initialize the member with a zeroing constructor, only to find that the region at that offset in the struct already has a value. The best we can do here is to invalidate that value and continue; neither the old default value nor the new 0 is correct for the entire struct after the member constructor call. The correct solution for this is to track region extents in the store. <rdar://problem/14914316> llvm-svn: 190530
* Fix a crash introduced in r189828.Matt Beaumont-Gay2013-09-091-0/+5
| | | | | | | The predicates in CXXRecordDecl which test various properties of special members can't be called on incomplete decls. llvm-svn: 190353
* Avoid double edges when constructing CFGsPavel Labath2013-09-061-0/+37
| | | | | | | | | | | | | | | | | | | | | Summary: If a noreturn destructor is executed while returning a value from a function, the resulting CFG has had two edges to the exit block. This crashed the analyzer, because it expects that blocks with no terminators have only one outgoing edge. I added code to avoid creating the second edge in this case. PS: The crashes did not manifest themselves always, as usually the NoReturnFunctionChecker would stop program evaluation before the analyzer hit the assertion, but in the case of lifetime extended temporaries, the checker failed to do that (which is a separate bug in itself). Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1513 llvm-svn: 190125
* [analyzer] Restructure a test filePavel Labath2013-09-051-708/+707
| | | | | | | | | | | | | | | | Summary: I've had a test failure here while experimenting and I've found that it's impossible to find what is wrong with the previous structure of the file. So I have grouped the expected output with the function that produces it, to make searching for discrepancies more obvious. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1595 llvm-svn: 190037
* Add an implicit dtor CFG node just before C++ 'delete' expressions.Jordan Rose2013-09-031-0/+46
| | | | | | | | | | | | | | This paves the way for adding support for modeling the destructor of a region before it is deleted. The statement "delete <expr>" now generates this series of CFG elements: 1. <expr> 2. [B1.1]->~Foo() (Implicit destructor) 3. delete [B1.1] Patch by Karthik Bhat! llvm-svn: 189828
* [analyzer] Add very limited support for temporary destructorsPavel Labath2013-09-022-8/+113
| | | | | | | | | | | | | | | | | | | | | This is an improved version of r186498. It enables ExprEngine to reason about temporary object destructors. However, these destructor calls are never inlined, since this feature is still broken. Still, this is sufficient to properly handle noreturn temporary destructors. Now, the analyzer correctly handles expressions like "a || A()", and executes the destructor of "A" only on the paths where "a" evaluted to false. Temporary destructor processing is still off by default and one has to explicitly request it by setting cfg-temporary-dtors=true. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1259 llvm-svn: 189746
* [analyzer] Treat the rvalue of a forward-declared struct as Unknown.Jordan Rose2013-08-301-1/+9
| | | | | | | | | | This will never happen in the analyzed code code, but can happen for checkers that over-eagerly dereference pointers without checking that it's safe. UnknownVal is a harmless enough value to get back. Fixes an issue added in r189590, caught by our internal buildbot. llvm-svn: 189688
* Sema: avoid reuse of Exprs when synthesizing operator=Pavel Labath2013-08-301-1/+46
| | | | | | | | | | | | | | | | | | Summary: Previously, Sema was reusing parts of the AST when synthesizing an assignment operator, turning it into a AS-dag. This caused problems for the static analyzer, which assumed an expression appears in the tree only once. Here I make sure to always create a fresh Expr, when inserting something into the AST, fixing PR16745 in the process. Reviewers: doug.gregor CC: cfe-commits, jordan_rose Differential Revision: http://llvm-reviews.chandlerc.com/D1425 llvm-svn: 189659
* [analyzer] Fix handling of "empty" structs with base classesPavel Labath2013-08-291-0/+23
| | | | | | | | | | | | | | | | | | | Summary: RegionStoreManager had an optimization which replaces references to empty structs with UnknownVal. Unfortunately, this check didn't take into account possible field members in base classes. To address this, I changed this test to "is empty and has no base classes". I don't consider it worth the trouble to go through base classes and check if all of them are empty. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1547 llvm-svn: 189590
* [analyzer] Add support for testing the presence of weak functions.Jordan Rose2013-08-281-0/+117
| | | | | | | | | | | | | | | | | | | | | | | | When casting the address of a FunctionTextRegion to bool, or when adding constraints to such an address, use a stand-in symbol to represent the presence or absence of the function if the function is weakly linked. This is groundwork for possible simple availability testing checks, and can already catch mistakes involving inverted null checks for weakly-linked functions. Currently, the implementation reuses the "extent" symbols, originally created for tracking the size of a malloc region. Since FunctionTextRegions cannot be dereferenced, the extent symbol will never be used for anything else. Still, this probably deserves a refactoring in the future. This patch does not attempt to support testing the presence of weak /variables/ (global variables), which would likely require much more of a change and a generalization of "region structure metadata", like the current "extents", vs. "region contents metadata", like CStringChecker's "string length". Patch by Richard <tarka.t.otter@googlemail.com>! llvm-svn: 189492
* [analyzer] Assume new returns non-null even under -fno-exceptionsPavel Labath2013-08-282-126/+44
| | | | | | | | | | | | | | | | | | Summary: -fno-exceptions does not implicitly attach a nothrow specifier to every operator new. Even in this mode, non-nothrow new must not return a null pointer. Failure to allocate memory can be signalled by other means, or just by killing the program. This behaviour is consistent with the compiler - even with -fno-exceptions, the generated code never tests for null (and would segfault if the opeator actually happened to return null). Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1528 llvm-svn: 189452
* Make the information about disabled ARCMT/Rewriter/StaticAnalyzer availableRoman Divacky2013-08-271-0/+2
| | | | | | | to lit and use this info to disable Analysis/FixIt/Rewriter/Analysis tests when those are not compiled into clang. llvm-svn: 189395
* [analyzer] Refactor conditional expression evaluating codePavel Labath2013-08-231-0/+12
| | | | | | | | | | | | | | | | | | | Summary: Instead of digging through the ExplodedGraph, to figure out which edge brought us here, I compute the value of conditional expression by looking at the sub-expression values. To do this, I needed to change the liveness algorithm a bit -- now, the full conditional expression also depends on all atomic sub-expressions, not only the outermost ones. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1340 llvm-svn: 189090
* [analyzer] Add a triple to test/Analysis/cfg.cppJordan Rose2013-08-191-1/+1
| | | | llvm-svn: 188683
* [analyzer] Don't run unreachable code checker on inlined functions.Jordan Rose2013-08-191-0/+19
| | | | | | | | | This is still an alpha checker, but we use it in certain tests to make sure something is not being executed. This should fix the buildbots. llvm-svn: 188682
* [analyzer] Assume that strings are no longer than SIZE_MAX/4.Jordan Rose2013-08-192-2/+36
| | | | | | | | | This keeps the analyzer from making silly assumptions, like thinking strlen(foo)+1 could wrap around to 0. This fixes PR16558. Patch by Karthik Bhat! llvm-svn: 188680
* Omit arguments of __builtin_object_size from the CFG.Jordan Rose2013-08-192-1/+34
| | | | | | | | | | | | | | | | | This builtin does not actually evaluate its arguments for side effects, so we shouldn't include them in the CFG. In the analyzer, rely on the constant expression evaluator to get the proper semantics, at least for now. (In the future, we could get ambitious and try to provide path- sensitive size values.) In theory, this does pose a problem for liveness analysis: a variable can be used within the __builtin_object_size argument expression but not show up as live. However, it is very unlikely that such a value would be used to compute the object size and not used to access the object in some way. <rdar://problem/14760817> llvm-svn: 188679
* [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.Jordan Rose2013-08-163-26/+47
| | | | | | | | | | | | | | | | | | | | This once again restores notes to following their associated warnings in -analyzer-output=text mode. (This is still only intended for use as a debugging aid.) One twist is that the warning locations in "regular" analysis output modes (plist, multi-file-plist, html, and plist-html) are reported at a different location on the command line than in the output file, since the command line has no path context. This commit makes -analyzer-output=text behave like a normal output format, which means that the *command line output will be different* in -analyzer-text mode. Again, since -analyzer-text is a debugging aid and lo-fi stand-in for a regular output mode, this change makes sense. Along the way, remove a few pieces of stale code related to the path diagnostic consumers. llvm-svn: 188514
* [analyzer] If realloc fails on an escaped region, that region doesn't leak.Jordan Rose2013-08-151-0/+10
| | | | | | | | | | | | | | | | | | When a region is realloc()ed, MallocChecker records whether it was known to be allocated or not. If it is, and the reallocation fails, the original region has to be freed. Previously, when an allocated region escaped, MallocChecker completely stopped tracking it, so a failed reallocation still (correctly) wouldn't require freeing the original region. Recently, however, MallocChecker started tracking escaped symbols, so that if it were freed we could check that the deallocator matched the allocator. This broke the reallocation model for whether or not a symbol was allocated. Now, MallocChecker will actually check if a symbol is owned, and only require freeing after a failed reallocation if it was owned before. PR16730 llvm-svn: 188468
* Fix FileCheck --check-prefix lines.Tim Northover2013-08-121-3/+3
| | | | | | | | | | Various tests had sprung up over the years which had --check-prefix=ABC on the RUN line, but "CHECK-ABC:" later on. This happened to work before, but was strictly incorrect. FileCheck is getting stricter soon though. Patch by Ron Ofir. llvm-svn: 188174
* [analyzer] Enable usage of temporaries in InitListExprsPavel Labath2013-08-091-0/+36
| | | | | | | | | | | | | | | | | | Summary: ExprEngine had code which specificaly disabled using CXXTempObjectRegions in InitListExprs. This was a hack put in r168757 to silence a false positive. The underlying problem seems to have been fixed in the mean time, as removing this code doesn't seem to break anything. Therefore I propose to remove it and solve PR16629 in the process. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1325 llvm-svn: 188059
* [analyzer] Warn when using 'delete' on an uninitialized variable.Jordan Rose2013-08-091-0/+32
| | | | | | Patch by Karthik Bhat, modified slightly by me. llvm-svn: 188043
* [analyzer] Don't process autorelease counts in synthesized function bodies.Jordan Rose2013-08-011-2/+401
| | | | | | | | | | | | | | | We process autorelease counts when we exit functions, but if there's an issue in a synthesized body the report will get dropped. Just skip the processing for now and let it get handled when the caller gets around to processing autoreleases. (This is still suboptimal: objects autoreleased in the caller context should never be warned about when exiting a callee context, synthesized or not.) Second half of <rdar://problem/14611722> llvm-svn: 187625
* [analyzer] Silently drop all reports within synthesized bodies.Jordan Rose2013-08-011-157/+180
| | | | | | | | | | | | | | | | | | | | | Much of our diagnostic machinery is set up to assume that the report end path location is valid. Moreover, the user may be quite confused when something goes wrong in our BodyFarm-synthesized function bodies, which may be simplified or modified from the real implementations. Rather than try to make this all work somehow, just drop the report so that we don't try to go on with an invalid source location. Note that we still handle reports whose /paths/ go through invalid locations, just not those that are reported in one. We do have to be careful not to lose warnings because of this. The impetus for this change was an autorelease being processed within the synthesized body, and there may be other possible issues that are worth reporting in some way. We'll take these as they come, however. <rdar://problem/14611722> llvm-svn: 187624
* Fix tests on targets that don't support thread_localPavel Labath2013-07-261-2/+2
| | | | | | This also reverts r187197. llvm-svn: 187199
* Add a triple. Should fix the windows bots.Rafael Espindola2013-07-261-1/+1
| | | | llvm-svn: 187197
* [analyzer] Fix FP warnings when binding a temporary to a local static variablePavel Labath2013-07-262-0/+20
| | | | | | | | | | | | | | | | Summary: When binding a temporary object to a static local variable, the analyzer would complain about a dangling reference even though the temporary's lifetime should be extended past the end of the function. This commit tries to detect these cases and construct them in a global memory region instead of a local one. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1133 llvm-svn: 187196
* [analyzer] Add regression test for the crash in PR16664.Jordan Rose2013-07-251-0/+32
| | | | | | | | This goes with r186925, which reverted Pavel's commit in r186498. Also, add a correctness test for the future. llvm-svn: 187133
* [analyzer] Weaken assertion to account for pointer-to-integer casts.Jordan Rose2013-07-251-5/+8
| | | | | | PR16690 llvm-svn: 187132
* Remove line number from test/Analysis/crash-trace.c.Jordan Rose2013-07-231-1/+1
| | | | | | ...and hopefully, finally, unbreak buildbots. llvm-svn: 186953
* Mark test/Analysis/crash-trace.c as requiring crash recovery.Jordan Rose2013-07-231-0/+1
| | | | | | This plus Rafael's fix at r186943 should keep all the buildbots happy. llvm-svn: 186950
* Run %clang_cc1, it is the one that actually crashes.Rafael Espindola2013-07-231-1/+1
| | | | llvm-svn: 186943
* [analyzer] Enable pseudo-destructor expressions.Jordan Rose2013-07-231-0/+14
| | | | | | | | These are cases where a scalar type is "destructed", usually due to template instantiation (e.g. "obj.~T()", where 'T' is 'int'). This has no actual effect and the analyzer should just skip over it. llvm-svn: 186927
* [analyzer] Add test for crash tracing (r186639)Jordan Rose2013-07-231-0/+18
| | | | llvm-svn: 186926
* Revert "[analyzer] Add very limited support for temporary destructors"Jordan Rose2013-07-234-68/+2
| | | | | | | | | | | | The analyzer doesn't currently expect CFG blocks with terminators to be empty, but this can happen when generating conditional destructors for a complex logical expression, such as (a && (b || Temp{})). Moreover, the branch conditions for these expressions are not persisted in the state. Even for handling noreturn destructors this needs more work. This reverts r186498. llvm-svn: 186925
* [analyzer] Handle C++11 member initializer expressions.Jordan Rose2013-07-171-0/+34
| | | | | | | | | Previously, we would simply abort the path when we saw a default member initialization; now, we actually attempt to evaluate it. Like default arguments, the contents of these expressions are not actually part of the current function, so we fall back to constant evaluation. llvm-svn: 186521
* [analyzer] Handle C string default values for const char * arguments.Jordan Rose2013-07-171-0/+9
| | | | | | | | | | Previously, SValBuilder knew how to evaluate StringLiterals, but couldn't handle an array-to-pointer decay for constant values. Additionally, RegionStore was being too strict about loading from an array, refusing to return a 'char' value from a 'const char' array. Both of these have been fixed. llvm-svn: 186520
* [analyzer] Treat std::initializer_list as opaque rather than aborting.Jordan Rose2013-07-173-1/+54
| | | | | | | | | | | | | | Previously, the use of a std::initializer_list (actually, a CXXStdInitializerListExpr) would cause the analyzer to give up on the rest of the path. Now, it just uses an opaque symbolic value for the initializer_list and continues on. At some point in the future we can add proper support for initializer_list, with access to the elements in the InitListExpr. <rdar://problem/14340207> llvm-svn: 186519
* [analyzer] Add very limited support for temporary destructorsPavel Labath2013-07-174-2/+68
| | | | | | | | | | | | | | | | | Summary: This patch enables ExprEndgine to reason about temporary object destructors. However, these destructor calls are never inlined, since this feature is still broken. Still, this is sufficient to properly handle noreturn temporary destructors and close bug #15599. I have also enabled the cfg-temporary-dtors analyzer option by default. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1131 llvm-svn: 186498
* [analyzer] Treat nullPtrType as a location type.Anna Zaks2013-07-121-0/+6
| | | | | | Fixes PR16584 (radar://14415223). llvm-svn: 186172
* [analyzer] Add support for __builtin_addressof.Jordan Rose2013-07-121-0/+7
| | | | | | ...so we don't regress on std::addressof. llvm-svn: 186140
* [analyzer] Remove bogus assert: in C++11, 'new' can do list-initialization.Jordan Rose2013-07-101-0/+10
| | | | | | | | | | | | | | Previously, we asserted that whenever 'new' did not include a constructor call, the type must be a non-record type. In C++11, however, uniform initialization syntax (braces) allow 'new' to construct records with list-initialization: "new Point{1, 2}". Removing this assertion should be perfectly safe; the code here matches what VisitDeclStmt does for regions allocated on the stack. <rdar://problem/14403437> llvm-svn: 186028
* [analyzer] Fixup for r185609: actually do suppress warnings coming out of ↵Anna Zaks2013-07-091-1/+7
| | | | | | | | | | | std::list. list is the name of a class, not a namespace. Change the test as well - the previous version did not test properly. Fixes radar://14317928. llvm-svn: 185898
* Add a test case for r185707/PR16547.Benjamin Kramer2013-07-051-0/+8
| | | | llvm-svn: 185708
* Replace 'grep foo | count 0' with 'not grep foo'.Rafael Espindola2013-07-041-1/+1
| | | | | | This avoids depending on pipefail not being used. llvm-svn: 185648
* [analyzer] Suppress reports reported in std::listAnna Zaks2013-07-042-0/+23
| | | | | | | | | | | The motivation is to suppresses false use-after-free reports that occur when calling std::list::pop_front() or std::list::pop_back() twice. The analyzer does not reason about the internal invariants of the list implementation, so just do not report any of warnings in std::list. Fixes radar://14317928. llvm-svn: 185609
* [analyzer] Make sure that inlined defensive checks work on div by zero.Anna Zaks2013-07-042-0/+37
| | | | | | | This suppresses a false positive in std::hash_map. Fixes radar://14255587. llvm-svn: 185608
* [analyzer] Improve handling of noreturn destructorsPavel Labath2013-07-031-0/+16
| | | | | | | | | | | | | | | | Summary: The analyzer incorrectly handled noreturn destructors which were hidden inside function calls. This happened because NoReturnFunctionChecker only listened for PostStmt events, which are not executed for destructor calls. I've changed it to listen to PostCall events, which should catch both cases. Reviewers: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D1056 llvm-svn: 185522
* [analyzer] Pointers-to-members are (currently) Locs, not NonLocs.Jordan Rose2013-07-021-0/+1
| | | | | | | | | | While we don't model pointers-to-members besides "null" and "non-null", we were using Loc symbols for valid pointers and NonLoc integers for the null case. This hit the assert committed in r185401. Fixed by using a true (Loc) null for null member pointers. llvm-svn: 185444
OpenPOWER on IntegriCloud