summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Add checker for iterators dereferenced beyond their range.Gabor Horvath2017-01-094-8/+266
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D25660 llvm-svn: 291430
* Fix for PR15623 (corrected r290413 reverted at 290415). The patch eliminates ↵Anton Yartsev2016-12-252-0/+21
| | | | | | | | | unwanted ProgramState checker data propagation from an operand of the logical operation to operation result. The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall. https://reviews.llvm.org/D22862 llvm-svn: 290505
* Revert changes made by r290413 until regression is fixed.Anton Yartsev2016-12-232-21/+0
| | | | llvm-svn: 290415
* Fix for PR15623. The patch eliminates unwanted ProgramState checker data ↵Anton Yartsev2016-12-232-0/+21
| | | | | | | | | propagation from an operand of the logical operation to operation result. The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall. https://reviews.llvm.org/D22862 llvm-svn: 290413
* [analyzer] Update GTestChecker to tighten API detectionDevin Coughlin2016-12-221-3/+14
| | | | | | | | | Update the GTestChecker to tighten up the API detection and make it cleaner in response to post-commit feedback. Also add tests for when temporary destructors are enabled to make sure we get the expected behavior when inlining constructors for temporaries. llvm-svn: 290352
* [analyzer] Improve suppress-on-sink behavior in incomplete analyses.Artem Dergachev2016-12-221-0/+31
| | | | | | | | | | | | | | | | | | | | | | | Warnings with suppress-on-sink are discarded during FlushReports when BugReporter notices that all paths in ExplodedGraph that pass through the warning eventually run into a sink node. However, suppress-on-sink fails to filter out false positives when the analysis terminates too early - by running into analyzer limits, such as block count limits or graph size limits - and the interruption hits the narrow window between throwing the leak report and reaching the no-return function call. In such case the report is there, however suppression-on-sink doesn't work, because the sink node was never constructed in the incomplete ExplodedGraph. This patch implements a very partial solution: also suppress reports thrown against a statement-node that corresponds to a statement that belongs to a no-return block of the CFG. rdar://problem/28832541 Differential Revision: https://reviews.llvm.org/D28023 llvm-svn: 290341
* [analyzer] Add checker modeling gtest APIs.Devin Coughlin2016-12-191-0/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gtest is a widely-used unit-testing API. It provides macros for unit test assertions: ASSERT_TRUE(p != nullptr); that expand into an if statement that constructs an object representing the result of the assertion and returns when the assertion is false: if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr)) ; else return ...; Unfortunately, the analyzer does not model the effect of the constructor precisely because (1) the copy constructor implementation is missing from the the header (so it can't be inlined) and (2) the boolean-argument constructor is constructed into a temporary (so the analyzer decides not to inline it since it doesn't reliably call temporary destructors right now). This results in false positives because the analyzer does not realize that the the assertion must hold along the non-return path. This commit addresses the false positives by explicitly modeling the effects of the two un-inlined constructors on the AssertionResult state. I've added a new package, "apiModeling", for these kinds of checkers that model APIs but don't emit any diagnostics. I envision all the checkers in this package always being on by default. This addresses the false positives reported in PR30936. Differential Revision: https://reviews.llvm.org/D27773 rdar://problem/22705813 llvm-svn: 290143
* [analyzer] Add sink after construction of temporary with no-return destructor.Devin Coughlin2016-12-191-0/+26
| | | | | | | | | | | | | | | | | | | The analyzer's CFG currently doesn't have nodes for calls to temporary destructors. This causes the analyzer to explore infeasible paths in which a no-return destructor would have stopped exploration and so results in false positives when no-return destructors are used to implement assertions. To mitigate these false positives, this patch stops generates a sink after evaluating a constructor on a temporary object that has a no-return destructor. This results in a loss of coverage because the time at which the destructor is called may be after the time of construction (especially for lifetime-extended temporaries). This addresses PR15599. rdar://problem/29131566 llvm-svn: 290140
* [analyzer] UnixAPIChecker: Don't diagnose for functions in C++ namespacesDevin Coughlin2016-12-171-0/+62
| | | | | | | | | | Update the UnixAPIChecker to not diagnose for calls to functions that are declared in C++ namespaces. This avoids false positives when a namespaced function has the same name as a Unix API. This address PR28331. llvm-svn: 290023
* [analyzer] Extend UnixAPIChecker open() checks to handle openat().Devin Coughlin2016-12-162-1820/+2063
| | | | | | | | | The openat() API has similar constraints to the open() API -- it just takes an extra parameter. rdar://problem/29526458 llvm-svn: 290005
* [analyzer] Fix crash in MallocChecker.Devin Coughlin2016-12-161-0/+6
| | | | | | | | | | | | | Fix a crash in the MallocChecker when the extent size for the argument to new[] is not known. A patch by Abramo Bagnara and Dániel Krupp! https://reviews.llvm.org/D27849 Differential Revision: https://reviews.llvm.org/D27849 llvm-svn: 289970
* [analyzer] Add another exception for Qt in MallocCheckerArtem Dergachev2016-12-162-1/+24
| | | | | | | | | | Treat pointers passed to QObject::connectImpl() as escaping. rdar://problem/29550440 Differential Revision: https://reviews.llvm.org/D27717 llvm-svn: 289939
* [analyzer] Teach the analyzer that pointers can escape into __cxa_demangleAnna Zaks2016-12-152-0/+23
| | | | | | | | This fixes a reported false positive in the malloc checker. Differential Revision: https://reviews.llvm.org/D27599 llvm-svn: 289886
* [analyzer] Refine the diagnostics in the nullability checker to ↵Anna Zaks2016-12-153-18/+18
| | | | | | | | | | | | differentiate between nil and null This is a big deal for ObjC, where nullability annotations are extensively used. I've also changed "Null" -> "null" and removed "is" as this is the pattern that Sema is using. Differential Revision: https://reviews.llvm.org/D27600 llvm-svn: 289885
* [analyzer] Refer to macro names in diagnostics for macros representing a literalAnna Zaks2016-12-154-1/+93
| | | | | | | | | | | | | When a macro expending to a literal is used in a comparison, use the macro name in the diagnostic rather than the literal. This improves readability of path notes. Added tests for various macro literals that could occur. Only BOOl, Int, and NULL tests have changed behavior with this patch. Differential Revision: https://reviews.llvm.org/D27726 llvm-svn: 289884
* [analyzer] Include type name in Retain Count Checker diagnosticsAnna Zaks2016-12-157-87/+87
| | | | | | | | | The more detailed diagnostic will make identifying which object the diagnostics refer to easier. Differential Revision: https://reviews.llvm.org/D27740 llvm-svn: 289883
* [analyzer] Add a new SVal to support pointer-to-member operations.Devin Coughlin2016-12-151-10/+144
| | | | | | | | | | | Add a new type of NonLoc SVal for C++ pointer-to-member operations. This SVal supports both pointers to member functions and pointers to member data. A patch by Kirill Romanenkov! Differential Revision: https://reviews.llvm.org/D25475 llvm-svn: 289873
* [analyzer] Detect ObjC properties that are both (copy) and Mutable.Artem Dergachev2016-12-131-0/+61
| | | | | | | | | | | | | | | When an Objective-C property has a (copy) attribute, the default setter for this property performs a -copy on the object assigned. Calling -copy on a mutable NS object such as NSMutableString etc. produces an immutable object, NSString in our example. Hence the getter becomes type-incorrect. rdar://problem/21022397 Differential Revision: https://reviews.llvm.org/D27535 llvm-svn: 289554
* [analyzer] Improve VirtualCallChecker diagnostics and move into optin package.Devin Coughlin2016-12-102-8/+66
| | | | | | | | | | | | | | | | | | The VirtualCallChecker is in alpha because its interprocedural diagnostics represent the call path textually in the diagnostic message rather than with a path sensitive diagnostic. This patch turns off the AST-based interprocedural analysis in the checker so that no call path is needed and improves with diagnostic text. With these changes, the checker is ready to be moved into the optin package. Ultimately the right fix is to rewrite this checker to be path sensitive -- but there is still value in enabling the checker for intraprocedural analysis only The interprocedural mode can be re-enabled with an -analyzer-config flag. Differential Revision: https://reviews.llvm.org/D26768 llvm-svn: 289309
* [analyzer] Add dispatch_data_create as a special case in RetainCountChecker.Artem Dergachev2016-12-081-0/+80
| | | | | | | | | | | | | This function receives a callback block. The analyzer suspects that this block may be used to take care of releasing the libdispatch object returned from the function. In fact, it doesn't - it only releases the raw data buffer. Inform the analyzer about that. Fixes the resulting false negatives. rdar://problem/22280098 Differential Revision: https://reviews.llvm.org/D27409 llvm-svn: 289047
* [analyzer] pr31226: Disable CastSizeChecker in C++ because it's not quite ready.Artem Dergachev2016-12-071-2/+21
| | | | | | | | Avoids a crash and a related false positive. Investigation by Daniel Krupp! llvm-svn: 288914
* [analyzer] Print type for SymbolRegionValues when dumping to streamDominic Chen2016-12-051-1/+1
| | | | | | | | | | Reviewers: NoQ, dcoughlin, zaks.anna Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D27365 llvm-svn: 288696
* [analyzer] ObjCGenerics: Warn only on mismatch for invariant type parametersDevin Coughlin2016-12-051-6179/+6231
| | | | | | | | | | | | | | | | | | | | | | | | | | On a method call, the ObjCGenerics checker uses the type tracked by DynamicTypePropagation for the receiver to to infer substituted parmeter types for the called methods and warns when the argument type does not match the parameter. Unfortunately, using the tracked type can result in false positives when the receiver has a non-invariant type parameter and has been intentionally upcast. For example, becaue NSArray's type parameter is covaraint, the following code is perfectly safe: NSArray<NSString *> *allStrings = ... NSDate *date = ...; NSArray<NSObject *> *allObjects = allStrings; NSArray<NSObject *> *moreObjects = [allObjects arrayByAddingObject:date]; but the checker currently warns that the date parameter is not an NSString *. To avoid this kind of false positive, the checker will now only warn when the class defining the called method has only invariant type parameters. rdar://problem/28803951 llvm-svn: 288677
* DR1213: element access on an array xvalue or prvalue produces an xvalue. In theRichard Smith2016-12-051-1/+1
| | | | | | | | | | | | | | latter case, a temporary array object is materialized, and can be lifetime-extended by binding a reference to the member access. Likewise, in an array-to-pointer decay, an rvalue array is materialized before being converted into a pointer. This caused IR generation to stop treating file-scope array compound literals as having static storage duration in some cases in C++; that has been rectified by modeling such a compound literal as an lvalue. This also improves clang's compatibility with GCC for those cases. llvm-svn: 288654
* DR616, and part of P0135R1: member access (or pointer-to-member access) on aRichard Smith2016-12-031-3/+3
| | | | | | | temporary produces an xvalue, not a prvalue. Support this by materializing the temporary prior to performing the member access. llvm-svn: 288563
* [analyzer] Drop explicit mention of range constraint solverDominic Chen2016-12-0132-40/+40
| | | | | | | | | | | | Summary: The basic constraint solver was dropped in rL162384, leaving the range constraint solver as the default and only constraint solver. Explicitly specifying it is unnecessary, and makes it difficult to test with other solver backends. Reviewers: zaks.anna, dcoughlin Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D26694 llvm-svn: 288372
* [analyzer] Construct temporary objects of correct types, destroy them properly.Artem Dergachev2016-11-301-0/+46
| | | | | | | | | | | | | | | | | | | | | | | When constructing a temporary object region, which represents the result of MaterializeTemporaryExpr, track down the sub-expression for which the temporary is necessary with a trick similar to the approach used in CodeGen, namely by using Expr::skipRValueSubobjectAdjustments(). Then, create the temporary object region with type of that sub-expression. That type would propagate further in a path-sensitive manner. During destruction of lifetime-extened temporaries, consult the type of the temporary object region, rather than the type of the lifetime-extending variable, in order to call the correct destructor (fixes pr17001) and, at least, not to crash by trying to call a destructor of a plain type (fixes pr19539). rdar://problem/29131302 rdar://problem/29131576 Differential Revision: https://reviews.llvm.org/D26839 llvm-svn: 288263
* [analyzer] SValExplainer: Support ObjC ivars and __block variables.Artem Dergachev2016-11-302-1/+28
| | | | | | | Additionally, explain the difference between normal and heap-based symbolic regions. llvm-svn: 288260
* [analyzer] Minor fixes and improvements to debug.ExprInspectionArtem Dergachev2016-11-302-0/+26
| | | | | | | | | | | | | | | | | | - Fix the bug with transition handling in ExprInspectionChecker's checkDeadSymbols implementation. - Test this bug by adding a new function clang_analyzer_numTimesReached() to catch number of passes through the code, which should be handy for testing against unintended state splits. - Add two more functions should help debugging issues quickly without running the debugger or dumping exploded graphs - clang_analyzer_dump() which dump()s an SVal argument to a warning message, and clang_analyzer_printState(), which dump()s the current program state to stderr. Differential Revision: https://reviews.llvm.org/D26835 llvm-svn: 288257
* [analyzer] Fix a crash on accessing a field within a literal-initialized union.Artem Dergachev2016-11-221-0/+13
| | | | | | | | | | | Because in case of unions we currently default-bind compound values in the store, this quick fix avoids the crash for this case. Patch by Ilya Palachev and independently by Alexander Shaposhnikov! Differential Revision: https://reviews.llvm.org/D26442 llvm-svn: 287618
* [analyzer] Add check for when block is called with too few arguments.Devin Coughlin2016-11-154-5/+14
| | | | | | | | | The CallAndMessageChecker has an existing check for when a function pointer is called with too few arguments. Extend this logic to handle the block case, as well. While we're at it, do a drive-by grammar correction ("less" --> "fewer") on the diagnostic text. llvm-svn: 287001
* [analyzer] Fix crash in NullabilityChecker calling block with too few argumentsDevin Coughlin2016-11-141-0/+12
| | | | | | | | | Fix a crash when checking parameter nullability on a block invocation with fewer arguments than the block declaration requires. rdar://problem/29237566 llvm-svn: 286901
* [analyzer] Update 'Automated' to 'Automatic' from r286694.Devin Coughlin2016-11-121-1/+1
| | | | | | ARC is 'Automatic Reference Counting' and not 'Automated Reference Counting'. llvm-svn: 286700
* [analyzer] Fix copy-pasta in NullableReturnedFromNonnullChecker checker name.Devin Coughlin2016-11-121-2/+2
| | | | | | | | | | The name of the NullableReturnedFromNonnullChecker in Checkers.td was accidentally "NullablePassedToNonnull", which made it impossible to explicitly turn the checker on. rdar://problem/28354459 llvm-svn: 286697
* [analyzer] Improve misleading RetainCountChcker diagnostic under ARCDevin Coughlin2016-11-121-0/+86
| | | | | | | | | | | | | | | | | | | | Under automated reference counting the analyzer treats a methods -- even those starting with 'copy' and friends -- as returning an unowned value. This is because ownership of CoreFoundation objects must be transferred to ARC with __bridge_transfer or CFBridgingRelease() before being returned as ARC-managed bridged objects. Unfortunately this could lead to a poor diagnostic inside copy methods under ARC where the analyzer would complain about a leak of a returned CF value inside a method "whose name does not start with 'copy'" -- even though the name did start with 'copy'. This commit improves the diagnostic under ARC to say inside a method "returned from a method managed by Automated Reference Counting". rdar://problem/28849667 llvm-svn: 286694
* [analyzer] Teach RetainCountChecker about VTCompressionSessionEncodeFrame()Devin Coughlin2016-11-111-0/+82
| | | | | | | | | | | | | | | The context argument passed to VideoToolbox's VTCompressionSessionEncodeFrame() function is ultimately passed to a callback supplied when creating the compression session and so may be freed by that callback. To suppress false positives in this case, teach the retain count checker to stop tracking that argument. This isn't suppressed by the usual callback context mechanism because the call to VTCompressionSessionEncodeFrame() doesn't include the callback itself. rdar://problem/27685213 llvm-svn: 286633
* Make output of -ast-print a valid C++ code.Serge Pavlov2016-11-101-1/+1
| | | | | | | | | | | | | | | | | | Output generated by option -ast-print looks like C/C++ code, and it really is for plain C. For C++ the produced output was not valid C++ code, but the differences were small. With this change the output is fixed and can be compiled. Tests are changed so that output produced by -ast-print is compiled again with the same flags and both outputs are compared. Option -ast-print is extensively used in clang tests but it itself was tested poorly, existing tests only checked that compiler did not crash. There are unit tests in file DeclPrinterTest.cpp, but they test only terse output mode. Differential Revision: https://reviews.llvm.org/D26452 llvm-svn: 286439
* [analyzer] StdLibraryFunctions: provide platform-specific function summaries.Artem Dergachev2016-11-021-1/+5
| | | | | | | | | | Because standard functions can be defined differently on different platforms, this commit introduces a method for constructing summaries with multiple variants, whichever matches better. It is also useful for supporting overloads. Differential Revision: https://reviews.llvm.org/D25940 llvm-svn: 285852
* [analyzer] Fix capitalization in ObjCSuperDealloc checker diagnostic.Devin Coughlin2016-11-011-14/+14
| | | | | | | | | Change "use of 'self'..." to "Use of 'self'...". The convention is to start diagnostics with a capital letter. rdar://problem/28322494 llvm-svn: 285759
* [analyzer] Allow undefined values in performTrivialCopy.Artem Dergachev2016-10-311-0/+34
| | | | | | | | | | | Reading from a garbage pointer should be modeled as garbage, and performTrivialCopy should be able to deal with any SVal input. Patch by Ilya Palachev! Differential Revision: https://reviews.llvm.org/D25727 llvm-svn: 285640
* [analyzer] MacOSXAPIChecker: Improve warnings for __block vars in dispatch_once.Artem Dergachev2016-10-311-0/+17
| | | | | | | | | | The checker already warns for __block-storage variables being used as a dispatch_once() predicate, however it refers to them as local which is not quite accurate, so we fix that. Differential Revision: https://reviews.llvm.org/D26159 llvm-svn: 285637
* [analyzer] MacOSXAPIChecker: Disallow dispatch_once_t in ivars and heap.Artem Dergachev2016-10-311-0/+92
| | | | | | | | | | Unlike global/static variables, calloc etc. functions that allocate ObjC objects behave differently in terms of memory barriers, and hacks that make dispatch_once as fast as it possibly could be start failing. Differential Revision: https://reviews.llvm.org/D25909 llvm-svn: 285605
* [analyzer] NumberObjectConversion: support more types, misc updates.Artem Dergachev2016-10-313-35/+130
| | | | | | | | | | | | | | | Support CFNumberRef and OSNumber objects, which may also be accidentally converted to plain integers or booleans. Enable explicit boolean casts by default in non-pedantic mode. Improve handling for warnings inside macros. Improve error messages. Differential Revision: https://reviews.llvm.org/D25731 llvm-svn: 285533
* [analyzer] Report CFNumberGetValue API misuseAnna Zaks2016-10-261-5/+19
| | | | | | | | | | | | This patch contains 2 improvements to the CFNumber checker: - Checking of CFNumberGetValue misuse. - Treating all CFNumber API misuse errors as non-fatal. (Previously we treated errors that could cause uninitialized memory as syncs and the truncation errors as non-fatal.) This implements a subset of functionality from https://reviews.llvm.org/D17954. Differential Revision: https://reviews.llvm.org/D25876 llvm-svn: 285253
* [analyzer] Fix an ARM buildbot after r284960.Artem Dergachev2016-10-242-2/+2
| | | | | | I guess we should always specify triples in all analyzer tests, regardless. llvm-svn: 284969
* [analyzer] Add StdLibraryFunctions checker.Artem Dergachev2016-10-242-0/+198
| | | | | | | | | | | | | | | This checker does not emit reports, however it influences the analysis by providing complete summaries for, or otherwise improving modeling of, various standard library functions. This should reduce the number of infeasible paths explored during analysis. The custom function summary format used in this checker is superior to body farms by causing less unnecessary state splits, which would result in better analysis performance. Differential Revision: https://reviews.llvm.org/D20811 llvm-svn: 284960
* Remove 24 instances of 'REQUIRES: shell'Reid Kleckner2016-10-201-3/+2
| | | | | | | | | | | | | | | | | Tests fall into one of the following categories: - The requirement was unnecessary - Additional quoting was required for backslashes in paths (see "sed -e 's/\\/\\\\/g'") in the sanitizer tests. - OpenMP used 'REQUIRES: shell' as a proxy for the test failing on Windows. Those tests fail there reliably, so use XFAIL instead. I tried not to remove shell requirements that were added to suppress flaky test failures, but if I screwed up, we can add it back as needed. llvm-svn: 284793
* alpha.core.UnreachableCode - don't warn about unreachable code inside macroDaniel Marjamaki2016-10-181-0/+7
| | | | | | | | In macros, 'do {...} while (0)' is often used. Don't warn about the condition 0 when it is unreachable. Differential Revision: https://reviews.llvm.org/D25606 llvm-svn: 284477
* [analyzer] Add NumberObjectConversion checker.Artem Dergachev2016-10-183-0/+158
| | | | | | | | | | | | | | | | | When dealing with objects that represent numbers, such as Objective-C NSNumber, the language provides little protection from accidentally interpreting the value of a pointer to such object as the value of the number represented by the object. Results of such mis-interpretation may be unexpected. The checker attempts to fill this gap in cases when the code is obviously incorrect. With "Pedantic" option enabled, this checker enforces a coding style to completely prevent errors of this kind (off by default). Differential Revision: https://reviews.llvm.org/D22968 llvm-svn: 284473
* [c++1z] Include "noexcept" in builtin function types where appropriate. FixesRichard Smith2016-10-181-1/+1
| | | | | | | an assertion failure looking up a matching ::operator delete for __builtin_operator_delete. llvm-svn: 284458
OpenPOWER on IntegriCloud