summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] TrackConstraintBRVisitor: Do not track unknown valuesCsaba Dabis2019-08-221-8/+4
| | | | | | | | | | | | Summary: - Reviewers: NoQ, Szelethus Reviewed By: NoQ, Szelethus Differential Revision: https://reviews.llvm.org/D66267 llvm-svn: 369604
* [analyzer] Mention whether an event is about a condition in a bug report part 2Kristof Umann2019-08-211-6/+114
| | | | | | | | | In D65724, I do a pretty thorough explanation about how I'm solving this problem, I think that summary nails whats happening here ;) Differential Revision: https://reviews.llvm.org/D65725 llvm-svn: 369596
* [analyzer] Don't make ConditionBRVisitor events prunable when the condition ↵Kristof Umann2019-08-211-0/+114
| | | | | | | | | | | is an interesting field Exactly what it says on the tin! Note that we're talking about interestingness in general, hence this isn't a control-dependency-tracking specific patch. Differential Revision: https://reviews.llvm.org/D65724 llvm-svn: 369589
* [analyzer] Mention whether an event is about a condition in a bug report part 1Kristof Umann2019-08-211-183/+183
| | | | | | | | | | Can't add much more to the title! This is part 1, the case where the collapse point isn't in the condition point is the responsibility of ConditionBRVisitor, which I'm addressing in part 2. Differential Revision: https://reviews.llvm.org/D65575 llvm-svn: 369574
* [analyzer] Fix a crash when destroying a non-region.Artem Dergachev2019-08-201-0/+30
| | | | | | | | | Add defensive check that prevents a crash when we try to evaluate a destructor whose this-value is a concrete integer that isn't a null. Differential Revision: https://reviews.llvm.org/D65349 llvm-svn: 369450
* [analyzer] Improve VirtualCallChecker and enable parts of it by default.Artem Dergachev2019-08-203-132/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling a pure virtual method during construction or destruction is undefined behavior. It's worth it to warn about it by default. That part is now known as the cplusplus.PureVirtualCall checker. Calling a normal virtual method during construction or destruction may be fine, but does behave unexpectedly, as it skips virtual dispatch. Do not warn about this by default, but let projects opt in into it by enabling the optin.cplusplus.VirtualCall checker manually. Give the two parts differentiated warning text: Before: Call to virtual function during construction or destruction: Call to pure virtual function during construction Call to virtual function during construction or destruction: Call to virtual function during destruction After: Pure virtual method call: Call to pure virtual method 'X::foo' during construction has undefined behavior Unexpected loss of virtual dispatch: Call to virtual method 'Y::bar' during construction bypasses virtual dispatch Also fix checker names in consumers that support them (eg., clang-tidy) because we now have different checker names for pure virtual calls and regular virtual calls. Also fix capitalization in the bug category. Differential Revision: https://reviews.llvm.org/D64274 llvm-svn: 369449
* [CallGraph] Take into accound calls that aren't within any function bodies.Artem Dergachev2019-08-202-0/+30
| | | | | | | | | | | | This patch improves Clang call graph analysis by adding in expressions that are not found in regular function bodies, such as default arguments or member initializers. Patch by Joshua Cranmer! Differential Revision: https://reviews.llvm.org/D65453 llvm-svn: 369321
* [analyzer] Turn an assert into an if conditionKristof Umann2019-08-171-1/+12
| | | | | | | Shocker, turns out that terminator conditions that are binary operators aren't always logical operators. llvm-svn: 369195
* [ASTImporter] Import ctor initializers after setting flags.Balazs Keri2019-08-163-0/+16
| | | | | | | | | | | | | | | | | | | | Summary: Code to import "ctor initializers" at import of functions is moved to be after the flags in the newly created function are imported. This fixes an error when the already created but incomplete (flags are not set) function declaration is accessed. Reviewers: martong, shafik, a_sidorin, a.sidorin Reviewed By: shafik Subscribers: rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D65935 llvm-svn: 369098
* [analyzer] Analysis: Silence checkersCsaba Dabis2019-08-163-1/+59
| | | | | | | | | | | | | | | | | | | | | | | Summary: This patch introduces a new `analyzer-config` configuration: `-analyzer-config silence-checkers` which could be used to silence the given checkers. It accepts a semicolon separated list, packed into quotation marks, e.g: `-analyzer-config silence-checkers="core.DivideZero;core.NullDereference"` It could be used to "disable" core checkers, so they model the analysis as before, just if some of them are too noisy it prevents to emit reports. This patch also adds support for that new option to the scan-build. Passing the option `-disable-checker core.DivideZero` to the scan-build will be transferred to `-analyzer-config silence-checkers=core.DivideZero`. Reviewed By: NoQ, Szelethus Differential Revision: https://reviews.llvm.org/D66042 llvm-svn: 369078
* [analyzer][NFC] Prove that we only track the evaluated part of the conditionKristof Umann2019-08-141-0/+35
| | | | | | | | | ...because we're working with a BugReporterVisitor, and the non-evaluated part of the condition isn't in the bugpath. Differential Revision: https://reviews.llvm.org/D65290 llvm-svn: 368853
* [analyzer][CFG] Don't track the condition of assertsKristof Umann2019-08-141-0/+239
| | | | | | | | | | | | | | Well, what is says on the tin I guess! Some more changes: * Move isInevitablySinking() from BugReporter.cpp to CFGBlock's interface * Rename and move findBlockForNode() from BugReporter.cpp to ExplodedNode::getCFGBlock() Differential Revision: https://reviews.llvm.org/D65287 llvm-svn: 368836
* [ASTImporter] Import default expression of param before creating the param.Balazs Keri2019-08-143-0/+25
| | | | | | | | | | | | | | | | | | | | | Summary: The default expression of a parameter variable should be imported before the parameter variable object is created. Otherwise the function is created with an incomplete parameter variable (default argument is nullptr) and in this intermediary state the expression is imported. This import can have a reference to the incomplete parameter variable that causes crash. Reviewers: martong, a.sidorin, shafik Reviewed By: martong Subscribers: rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D65577 llvm-svn: 368818
* [analyzer] Note last writes to a condition only in a nested stackframeKristof Umann2019-08-141-24/+41
| | | | | | | | | Exactly what it says on the tin! The comments in the code detail this a little more too. Differential Revision: https://reviews.llvm.org/D64272 llvm-svn: 368817
* [analyzer] Track the right hand side of the last store regardless of its valueKristof Umann2019-08-133-15/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The following code snippet taken from D64271#1572188 has an issue: namely, because `flag`'s value isn't undef or a concrete int, it isn't being tracked. int flag; bool coin(); void foo() { flag = coin(); } void test() { int *x = 0; int local_flag; flag = 1; foo(); local_flag = flag; if (local_flag) x = new int; foo(); local_flag = flag; if (local_flag) *x = 5; } This, in my opinion, makes no sense, other values may be interesting too. Originally added by rC185608. Differential Revision: https://reviews.llvm.org/D64287 llvm-svn: 368773
* [analyzer] Prune calls to functions with linear CFGs that return a non-zero ↵Kristof Umann2019-08-133-33/+126
| | | | | | | | | | | | | | | | constrained value During the evaluation of D62883, I noticed a bunch of totally meaningless notes with the pattern of "Calling 'A'" -> "Returning value" -> "Returning from 'A'", which added no value to the report at all. This patch (not only affecting tracked conditions mind you) prunes diagnostic messages to functions that return a value not constrained to be 0, and are also linear. Differential Revision: https://reviews.llvm.org/D64232 llvm-svn: 368771
* [analyzer] exploded-graph-rewriter: Implement displaying Store pointers.Artem Dergachev2019-08-132-1/+2
| | | | | | | | | They're useful when trying to understand what's going on inside your LazyCompoundValues. Differential Revision: https://reviews.llvm.org/D65427 llvm-svn: 368769
* [analyzer] exploded-graph-rewriter: Implement manual graph trimming.Artem Dergachev2019-08-131-11/+21
| | | | | | | | | | | | | | | | | | | When -trim-egraph is unavailable (say, when you're debugging a crash on a real-world code that takes too long to reduce), it makes sense to view the untrimmed graph up to the crashing node's predecessor, then dump the ID (or a pointer) of the node in the attached debugger, and then trim the dumped graph in order to keep only paths from the root to the node. The newly added --to flag does exactly that: $ exploded-graph-rewriter.py ExprEngine.dot --to 0x12229acd0 Multiple nodes can be specified. Stable IDs of nodes can be used instead of pointers. Differential Revision: https://reviews.llvm.org/D65345 llvm-svn: 368768
* [analyzer] exploded-graph-rewriter: NFC: Refactor explorers into trimmers.Artem Dergachev2019-08-131-0/+0
| | | | | | | | | | | | | | | | | | | | | | | Explorers aren't the right abstraction. For the purposes of displaying svg files we don't care in which order do we explore the nodes. We may care about this for other analyses, but we're not there yet. The function of cutting out chunks of the graph is performed poorly by the explorers, because querying predecessors/successors on the explored nodes yields original successors/predecessors even if they aren't being explored. Introduce a new entity, "trimmers", that do one thing but to it right: cut out chunks of the graph. Trimmers mutate the graph, so stale edges aren't even visible to their consumers in the pipeline. Additionally, trimmers are intrinsically composable: multiple trimmers can be applied to the graph sequentially. Refactor the single-path explorer into the single-path trimmer. Rename the test file for consistency. Differential Revision: https://reviews.llvm.org/D65344 llvm-svn: 368767
* [analyzer] exploded-graph-rewriter: Open the converted graph immediately.Artem Dergachev2019-08-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Change the default behavior: the tool no longer dumps the rewritten .dot file to stdout, but instead it automatically converts it into an .html file (which essentially wraps an .svg file) and immediately opens it with the default web browser. This means that the tool should now be fairly easy to use: $ exploded-graph-rewriter.py /tmp/ExprEngine.dot The benefits of wrapping the .svg file into an .html file are: - It'll open in a web browser, which is the intended behavior. An .svg file would be open with an image viewer/editor instead. - It avoids the white background around the otherwise dark svg area in dark mode. The feature can be turned off by passing a flag '--rewrite-only'. The LIT substitution is updated to enforce the old mode because we don't want web browsers opening on our buildbots. Differential Revision: https://reviews.llvm.org/D65250 llvm-svn: 368766
* [analyzer] Disable the checker-plugins test on Darwin.Artem Dergachev2019-08-131-0/+4
| | | | | | Fixes a buildbot. llvm-svn: 368765
* More warnings regarding gsl::Pointer and gsl::Owner attributesGabor Horvath2019-08-091-1/+2
| | | | | | Differential Revision: https://reviews.llvm.org/D65120 llvm-svn: 368446
* [analyzer] CastValueChecker: Model castAs(), getAs()Csaba Dabis2019-08-091-6/+112
| | | | | | | | | | Summary: Thanks to Kristóf Umann for the great idea! Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D65889 llvm-svn: 368383
* [analyzer] ConditionBRVisitor: Fix HTML PathDiagnosticPopUpPiecesCsaba Dabis2019-08-095-80/+99
| | | | | | | | | | | | | | | | Summary: A condition could be a multi-line expression where we create the highlight in separated chunks. PathDiagnosticPopUpPiece is not made for that purpose, it cannot be added to multiple lines because we have only one ending part which contains all the notes. So that it cannot have multiple endings and therefore this patch narrows down the ranges of the highlight to the given interesting variable of the condition. It prevents HTML-breaking injections. Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D65663 llvm-svn: 368382
* [OPENMP]Add support for analysis of linear variables and step.Alexey Bataev2019-08-081-43/+72
| | | | | | | | | | | | | | | | | Summary: Added support for basic analysis of the linear variables and linear step expression. Linear loop iteration variables must be excluded from this analysis, only non-loop iteration variables must be analyzed. Reviewers: NoQ Subscribers: guansong, cfe-commits, caomhin, kkwli0 Tags: #clang Differential Revision: https://reviews.llvm.org/D65461 llvm-svn: 368295
* [CrossTU] Handle case when no USR could be generated during Decl search.Balazs Keri2019-08-064-0/+36
| | | | | | | | | | | | | | | | | | | Summary: When searching for a declaration to be loaded the "lookup name" for every other Decl is computed. If the USR can not be determined here should be not an assert, instead skip this Decl. Reviewers: martong Reviewed By: martong Subscribers: rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D65445 llvm-svn: 368020
* [Analyzer] Iterator Checkers - Fix for Crash on Iterator DifferencesAdam Balogh2019-08-053-1/+9
| | | | | | | Iterators differences were mistakenly handled as random decrements which causes an assertion. This patch fixes this. llvm-svn: 367802
* [analyzer] StackFrameContext: Add NodeBuilderContext::blockCount() to its ↵Csaba Dabis2019-08-013-6/+43
| | | | | | | | | | | | | | | | | | profile Summary: It allows discriminating between stack frames of the same call that is called multiple times in a loop. Thanks to Artem Dergachev for the great idea! Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D65587 llvm-svn: 367608
* Rename two clang tests from .cc to .cpp.Nico Weber2019-08-011-2/+1
| | | | | | | | | | clang/test/lit.cfg.py doesn't list .cc as test extension, so these tests never ran. Tweak one of the two tests to actually pass, now that it runs. (The other one was already passing.) llvm-svn: 367574
* [Fix] Customize warnings for missing built-in typesJohannes Doerfert2019-07-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we detect a built-in declaration for which we cannot derive a type matching the pattern in the Builtins.def file, we currently emit a warning that the respective header is needed. However, this is not necessarily the behavior we want as it has no connection to the location of the declaration (which can actually be in the header in question). Instead, this warning is generated - if we could not build the type for the pattern on file (for some reason). Here we should make the reason explicit. The actual problem is otherwise circumvented as the warning is misleading, see [0] for an example. - if we could not build the type for the pattern because we do not have a type on record, possible since D55483, we should not emit any warning. See [1] for a legitimate problem. This patch address both cases. For the "setjmp" family a new warning is introduced and for built-ins without type on record, so far "pthread_create", we do not emit the warning anymore. Also see: PR40692 [0] https://lkml.org/lkml/2019/1/11/718 [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=235583 Differential Revision: https://reviews.llvm.org/D58091 llvm-svn: 367387
* Fix taint-generic.c on Windows, handle case in OS errorReid Kleckner2019-07-291-1/+1
| | | | llvm-svn: 367249
* [analyzer] Add yaml parser to GenericTaintCheckerGabor Borsik2019-07-285-3/+105
| | | | | | | | | | | | | | | | | | | | | While we implemented taint propagation rules for several builtin/standard functions, there's a natural desire for users to add such rules to custom functions. A series of patches will implement an option that allows users to annotate their functions with taint propagation rules through a YAML file. This one adds parsing of the configuration file, which may be specified in the commands line with the analyzer config: alpha.security.taint.TaintPropagation:Config. The configuration may contain propagation rules, filter functions (remove taint) and sink functions (give a warning if it gets a tainted value). I also added a new header for future checkers to conveniently read YAML files as checker options. Differential Revision: https://reviews.llvm.org/D59555 llvm-svn: 367190
* [OPENMP]Add support for analysis of reduction variables.Alexey Bataev2019-07-261-143/+170
| | | | | | | | | | | | | | | | | | | Summary: Reduction variables are the variables, for which the private copies must be created in the OpenMP regions. Then they are initialized with the predefined values depending on the reduction operation. After exit from the OpenMP region the original variable is updated using the reduction value and the value of the original reduction variable. Reviewers: NoQ Subscribers: guansong, jdoerfert, caomhin, kkwli0, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D65106 llvm-svn: 367116
* Fix failing test plist-macros-with-expansion-ctu.cBalazs Keri2019-07-251-2/+1
| | | | llvm-svn: 367013
* [CrossTU] Fix plist macro expansion if macro in other file.Balazs Keri2019-07-254-0/+109
| | | | | | | | | | | | | | | | | | | | | Summary: When cross TU analysis is used it is possible that a macro expansion is generated for a macro that is defined (and used) in other than the main translation unit. To get the expansion for it the source location in the original source file and original preprocessor is needed. Reviewers: martong, xazax.hun, Szelethus, ilya-biryukov Reviewed By: Szelethus Subscribers: mgorny, NoQ, ilya-biryukov, rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64638 llvm-svn: 367006
* [OPENMP]Add support for analysis of firstprivate variables.Alexey Bataev2019-07-221-107/+184
| | | | | | | | | | | | | | | | | | Summary: Firstprivate variables are the variables, for which the private copies must be created in the OpenMP regions and must be initialized with the original values. Thus, we must report if the uninitialized variable is used as firstprivate. Reviewers: NoQ Subscribers: guansong, jdoerfert, caomhin, kkwli0, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64765 llvm-svn: 366689
* [analyzer] MallocChecker: Prevent Integer Set Library false positivesCsaba Dabis2019-07-181-0/+37
| | | | | | | | | | | | | | Summary: Integer Set Library using retain-count based allocation which is not modeled in MallocChecker. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64680 llvm-svn: 366391
* [OPENMP]Fix PR42632: crash on the analysis of the OpenMP constructs.Alexey Bataev2019-07-171-0/+4
| | | | | | | Fixed processing of the CapturedStmt children to fix the crash of the OpenMP constructs during analysis. llvm-svn: 366357
* [OPENMP]Add support for analysis of if clauses.Alexey Bataev2019-07-161-235/+297
| | | | | | | | | | | | | | | | Summary: Added support for analysis of if clauses in the OpenMP directives to be able to check for the use of uninitialized variables. Reviewers: NoQ Subscribers: guansong, jfb, jdoerfert, caomhin, kkwli0, cfe-commits Tags: clang Differential Revision: https://reviews.llvm.org/D64646 llvm-svn: 366211
* Revert "[OPENMP]Add support for analysis of if clauses."Ali Tamur2019-07-161-297/+235
| | | | | | | This reverts commit rL366068. The patch broke 86 tests under clang/test/OpenMP/ when run with address sanitizer. llvm-svn: 366169
* [OPENMP]Add support for analysis of if clauses.Alexey Bataev2019-07-151-235/+297
| | | | | | | | | | | | | | | | Summary: Added support for analysis of if clauses in the OpenMP directives to be able to check for the use of uninitialized variables. Reviewers: NoQ Subscribers: guansong, jfb, jdoerfert, caomhin, kkwli0, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64646 llvm-svn: 366068
* NFC: Unforget a colon in a few CHECK: directives.Artem Dergachev2019-07-121-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D64526 llvm-svn: 365863
* [analyzer] exploded-graph-rewriter: Improve source location dumps.Artem Dergachev2019-07-126-12/+44
| | | | | | | | - Correctly display macro expansion and spelling locations. - Use the same procedure to display location context call site locations. - Display statement IDs for program points. llvm-svn: 365861
* [analyzer] exploded-graph-rewriter: Fix filenames in program point.Artem Dergachev2019-07-111-1/+2
| | | | | | Fix a typo in JSON field name. llvm-svn: 365827
* [OPENMP]Initial fix PR42392: Improve -Wuninitialized warnings for OpenMP ↵Alexey Bataev2019-07-111-0/+340
| | | | | | | | | | | | | | | | | | | | | | | programs. Summary: Some OpenMP clauses rely on the values of the variables. If the variable is not initialized and used in OpenMP clauses that depend on the variables values, it should be reported that the uninitialized variable is used in the OpenMP clause expression. This patch adds initial processing for uninitialized variables in OpenMP constructs. Currently, it checks for use of the uninitialized variables in the structured blocks. Reviewers: NoQ, Szelethus, dcoughlin, xazax.hun, a.sidorin, george.karpenkov, szepet Subscribers: rnkovacs, guansong, jfb, jdoerfert, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64356 llvm-svn: 365786
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-102-1/+138
| | | | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. (It reapplies the reverted 'llvm-svn: 365582' patch with proper test file.) Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365585
* Revert "[analyzer] CastValueChecker: Model casts"Csaba Dabis2019-07-092-134/+1
| | | | | | This reverts commit 27cf6664437efd640bb6db5594bafcce68fa2854. llvm-svn: 365584
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-092-1/+134
| | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365582
* [analyzer] exploded-graph-rewriter: Implement a topology-only mode.Artem Dergachev2019-07-081-0/+32
| | | | | | | | | | In this mode the rewriter will only rewrite program points and omit program states. Useful for understanding the rough topology of the graph. Differential Revision: https://reviews.llvm.org/D64264 llvm-svn: 365410
* [analyzer] exploded-graph-rewriter: Implement a single-path mode.Artem Dergachev2019-07-081-0/+37
| | | | | | | | | | Instead of rewriting the whole graph, rewrite the leftmost path in the graph. Useful for trimmed graphs that are still too large to display due to multiple equivalent reports mixed into them. Differential Revision: https://reviews.llvm.org/D64263 llvm-svn: 365409
OpenPOWER on IntegriCloud