summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "Revert "[analyzer] Make MallocChecker more robust against custom ↵Devin Coughlin2016-10-161-0/+32
| | | | | | | | | redeclarations"" This reverts commit r284340 to reapply r284335. The bot breakage was due to an unrelated change in the polybench test suite. llvm-svn: 284351
* Revert "[analyzer] Make MallocChecker more robust against custom redeclarations"Devin Coughlin2016-10-161-32/+0
| | | | | | | | | | This reverts commit r284335. It appears to be causing test-suite compile-time and execution-time performance measurements to take longer than expected on several bots. This is surprising, because r284335 is a static-analyzer-only change. llvm-svn: 284340
* [analyzer] Make MallocChecker more robust against custom redeclarationsDevin Coughlin2016-10-161-0/+32
| | | | | | | | | | | | | Add additional checking to MallocChecker to avoid crashing when memory routines have unexpected numbers of arguments. You wouldn't expect to see much of this in normal code (-Wincompatible-library-redeclaration warns on this), but, for example, CMake tests can generate these. This is PR30616. rdar://problem/28631974 llvm-svn: 284335
* Revert "[analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker""Devin Coughlin2016-10-163-99/+9
| | | | | | | | | | | | Revert: r283662: [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker" r283660: [analyzer] Fix build error after r283660 - remove constexpr strings. It was causing an internal build bot to fail. It looks like in some cases adding an extra note can cause scan-build plist output to drop a diagnostic altogether. llvm-svn: 284317
* [analyzer] DeallocChecker: Don't warn about directly-set IBOutlet ivars on macOSDevin Coughlin2016-10-121-1/+70
| | | | | | | | | | | | | | | | On macOS (but not iOS), if an ObjC property has no setter, the nib-loading code for an IBOutlet is documented as directly setting the backing ivar without retaining the value -- even if the property is 'retain'. This resulted in false positives from the DeallocChecker for code that did not release such ivars in -dealloc. To avoid these false positives, treat IBOutlet ivars that back a property without a setter as having an unknown release requirement in macOS. rdar://problem/28507353 llvm-svn: 284084
* [analyzer] Re-apply r283094 "Improve CloneChecker diagnostics"Artem Dergachev2016-10-0811-29/+214
| | | | | | The parent commit (r283092) was reverted before and now finally landed. llvm-svn: 283661
* [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker"Artem Dergachev2016-10-083-9/+87
| | | | | | The parent commit (r283092) was reverted before and now finally landed. llvm-svn: 283660
* [analyzer] Don't merge different return nodes in ExplodedGraphDaniel Marjamaki2016-10-072-2/+14
| | | | | | | | Returns when calling an inline function should not be merged in the ExplodedGraph unless they are same. Differential Revision: https://reviews.llvm.org/D25326 llvm-svn: 283554
* [analyzer] Add explanation why analyzer report is not generated (fix for ↵Anton Yartsev2016-10-062-0/+16
| | | | | | | | | PR12421). Currently if the path diagnostic consumer (e.g HTMLDiagnostics and PlistDiagnostics) do not support cross file diagnostics then the path diagnostic report is silently omitted in the case of cross file diagnostics. The patch adds a little verbosity to Clang in this case. The patch also adds help entry for the "--analyzer-output" driver option. llvm-svn: 283499
* PR22924, PR22845, some of CWG1464: When checking the initializer for an arrayRichard Smith2016-10-051-2/+2
| | | | | | | | | | | | | | | | | | new expression, distinguish between the case of a constant and non-constant initializer. In the former case, if the bound is erroneous (too many initializer elements, bound is negative, or allocated size overflows), reject, and take the bound into account when determining whether we need to default-construct any elements. In the remanining cases, move the logic to check for default-constructibility of trailing elements into the initialization code rather than inventing a bogus array bound, to cope with cases where the number of initialized elements is not the same as the number of initializer list elements (this can happen due to string literal initialization or brace elision). This also fixes rejects-valid and crash-on-valid errors when initializing a new'd array of character type from a braced string literal. llvm-svn: 283406
* [analyzer] Improve "Assuming..." diagnostic pieces for logical operators.Artem Dergachev2016-10-052-148/+76
| | | | | | | | | | | | | | | | | | Logical short-circuit operators now act like other branch conditions. If the symbolic value of the left-hand side is not known to be true or false (based on the previous execution path), the "Assuming" event piece is added in order to explain that the analyzer is adding a new assumption. Additionally, when the assumption is made against the right-hand side of the logical operator (i.e. when the operator itself acts as a condition in another CFG terminator), the "Assuming..." piece is written out for the right-hand side of the operator rather than for the whole operator. This allows expression-specific diagnostic message text to be constructed. Differential Revision: https://reviews.llvm.org/D25092 llvm-svn: 283302
* [analyzer] Add "Assuming..." diagnostic pieces for unsupported conditions.Artem Dergachev2016-10-0510-59/+2273
| | | | | | | | | | | | | | | | | | | | In the analyzer's path-sensitive reports, when a report goes through a branch and the branch condition cannot be decided to be definitely true or false (based on the previous execution path), an event piece is added that tells the user that a new assumption is added upon the symbolic value of the branch condition. For example, "Assuming 'a' is equal to 3". The text of the assumption is hand-crafted in various manners depending on the AST expression. If the AST expression is too complex and the text of the assumption fails to be constructed, the event piece is omitted. This causes loss of information and misunderstanding of the report. Do not omit the event piece even if the expression is too complex; add a piece with a generic text instead. Differential Revision: https://reviews.llvm.org/D23300 llvm-svn: 283301
* Revert "[analyzer] Improve CloneChecker diagnostics" as its depends on ↵Vitaly Buka2016-10-0411-214/+29
| | | | | | | | reverted r283092 This reverts commit r283094. llvm-svn: 283182
* Revert "[analyzer] Add extra notes to ObjCDeallocChecker" as its depends on ↵Vitaly Buka2016-10-043-87/+9
| | | | | | | | reverted r283092 This reverts commit r283093. llvm-svn: 283181
* [StaticAnalyser] Add test case to ensure that unreachable code is found.Daniel Marjamaki2016-10-031-1/+12
| | | | | | https://reviews.llvm.org/D24905 llvm-svn: 283096
* [StaticAnalyzer] Fix UnreachableCode false positives.Daniel Marjamaki2016-10-031-0/+10
| | | | | | | | When there is 'do { } while (0);' in the code the ExplodedGraph and UnoptimizedCFG did not match. Differential Revision: https://reviews.llvm.org/D24759 llvm-svn: 283095
* [analyzer] Improve CloneChecker diagnosticsArtem Dergachev2016-10-0311-29/+214
| | | | | | | | | | | | | | | | | | Highlight code clones referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Change warning text to more clang-ish. Remove suggestions from the copy-paste error checker diagnostics, because currently our suggestions are strictly 50% wrong (we do not know which of the two code clones contains the error), and for that reason we should not sound as if we're actually suggesting this. Hopefully a better solution would bring them back. Make sure the suspicious clone pair structure always mentions the correct variable for the second clone. Differential Revision: https://reviews.llvm.org/D24916 llvm-svn: 283094
* [analyzer] Add extra notes to ObjCDeallocCheckerArtem Dergachev2016-10-033-9/+87
| | | | | | | | | | The report is now highlighting instance variables and properties referenced by the warning message with the help of the extra notes feature recently introduced in r283092. Differential Revision: https://reviews.llvm.org/D24915 llvm-svn: 283093
* [StaticAnalyzer] Fix false positives for vardecls that are technically ↵Daniel Marjamaki2016-09-281-0/+15
| | | | | | | | | | | | | | | unreachable but they are needed. Example: switch (x) { int a; // <- This is unreachable but needed case 1: a = ... Differential Revision: https://reviews.llvm.org/D24905 llvm-svn: 282574
* [analyzer] Improve CastToStruct checker so it can also detect widening casts ↵Daniel Marjamaki2016-09-262-1/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | of struct data Example: struct AB { int A; int B; }; struct ABC { int A; int B; int C; }; void f() { struct AB Data; struct ABC *P = (struct ABC *)&Data; } Differential Revision: https://reviews.llvm.org/D23508 llvm-svn: 282411
* [analyzer] Fix crash in RetainCountChecker::checkEndFunctionAlexander Shaposhnikov2016-09-231-2/+6
| | | | | | | | | | | | | | | | | The class BodyFarm creates bodies for OSAtomicCompareAndSwap*, objc_atomicCompareAndSwap*, dispatch_sync*, dispatch_once* and for them the flag isBodyAutosynthesized is set to true. This diff 1. makes AnalysisConsumer::HandleCode skip the autosynthesized code 2. replaces assert(LCtx->getParent()) in RetainCountChecker::checkEndFunction by assert(!LCtx->inTopFrame()) (minor cleanup) Test plan: make -j8 check-clang-analysis Differential revision: https://reviews.llvm.org/D24792 llvm-svn: 282293
* [analyzer] Add a checker that detects blocks in critical sectionsAnna Zaks2016-09-201-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock. Example: mutex_t m; void f() { sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked] // do some work } void foobar() { lock(m); f(); unlock(m); } A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D21506 llvm-svn: 282011
* [analyzer] Calculate extent size for memory regions allocated by new expression.Gabor Horvath2016-09-191-0/+150
| | | | | | | | | | | ArrayBoundChecker did not detect out of bounds memory access errors in case an array was allocated by the new expression. This patch resolves this issue. Patch by Daniel Krupp! Differential Revision: https://reviews.llvm.org/D24307 llvm-svn: 281934
* [analyzer] Fix ExprEngine::VisitMemberExprAlexander Shaposhnikov2016-09-131-0/+11
| | | | | | | | | | | AST may contain intermediate ParenExpr nodes between MemberExpr and ArrayToPointerDecay. This diff adjusts the check in ExprEngine::VisitMemberExpr accordingly. Test plan: make -j8 check-clang-analysis Differential revision: https://reviews.llvm.org/D24484 llvm-svn: 281373
* [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>Aleksei Sidorin2016-09-011-0/+10
| | | | | | | | | This patch also introduces AnalysisOrderChecker which is intended for testing of callback call correctness. Differential Revision: https://reviews.llvm.org/D23804 llvm-svn: 280367
* [analyzer] Add more FileIDs to PlistDiagnostic map to avoid assertionAleksei Sidorin2016-09-013-0/+150
| | | | | | | | | | | | | Some FileIDs that may be used by PlistDiagnostics were not added while building a list of pieces. This caused assertion violation in GetFID() function. This patch adds some missing FileIDs to avoid the assertion. It also contains small refactoring of PlistDiagnostics::FlushDiagnosticsImpl(). Patch by Aleksei Sidorin, Ilya Palachev. Differential Revision: https://reviews.llvm.org/D22090 llvm-svn: 280360
* Fix all tests under test/CXX (and test/Analysis) to pass if clang's defaultRichard Smith2016-08-311-1/+1
| | | | | | C++ language standard is not C++98. llvm-svn: 280309
* [analyzer] Use lazily created buffer in EmptyLocalizationContextCheckerDevin Coughlin2016-08-302-1/+12
| | | | | | | | | | | Fix a crash when relexing the underlying memory buffer to find incorrect arguments to NSLocalizedString(). With precompiled headers, the raw buffer may be NULL. Instead, use the source manager to get the buffer, which will lazily create the buffer for precompiled headers. rdar://problem/27429091 llvm-svn: 280174
* [analyzer] Fix CloneDetector crash on calling methods of class templates.Artem Dergachev2016-08-231-0/+12
| | | | | | | | | | | | | | If a call expression represents a method call of a class template, and the method itself isn't templated, then the method may be considered to be a template instantiation without template specialization arguments. No longer crash when we could not find template specialization arguments. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23780 llvm-svn: 279529
* Reapply "[analyzer] Added valist related checkers."Gabor Horvath2016-08-223-0/+341
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279427
* [analyzer] Correctly add assumptions based on array bounds.Gabor Horvath2016-08-221-9/+17
| | | | | | | | Also simplify the constraints generated by the checker. Differential Revision: https://reviews.llvm.org/D23112 llvm-svn: 279425
* [analyzer] Make CloneDetector consider macro expansions.Artem Dergachev2016-08-202-0/+117
| | | | | | | | | | | | | | | | | So far macro-generated code was treated by the CloneDetector as normal code. This caused that some macros where reported as false-positive clones because large chunks of code coming from otherwise concise macro expansions were treated as copy-pasted code. This patch ensures that macros are treated in the same way as literals/function calls. This prevents macros that expand into multiple statements from being reported as clones. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23316 llvm-svn: 279367
* [analyzer] Make CloneDetector consider template arguments.Artem Dergachev2016-08-201-0/+54
| | | | | | | | | | | For example, code samples `isa<Stmt>(S)' and `isa<Expr>(S)' are no longer considered to be clones. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23555 llvm-svn: 279366
* [analyzer] Weaken assertion in trackNullOrUndefValue()Devin Coughlin2016-08-191-4/+26
| | | | | | | | | | | | | | | | | We should ignore paren casts when making sure that the semantic expression in a PseudoObjectExpr for an ObjC getter is a message send. This has no other intended functionality change. Adding a test for this exposed an interesting issue in another test case that only manifests under ARC. trackNullOrUndefValue() is not properly suppressing for nil values that are the result of nil propagation from a nil receiver when the nil is returned from a function. I've added a FIXME for that missing suppression. rdar://problem/27290568 llvm-svn: 279181
* [analyzer] Teach CloneDetector to find clones that look like copy-paste errors.Artem Dergachev2016-08-181-0/+97
| | | | | | | | | | | | | | | | | | | The original clone checker tries to find copy-pasted code that is exactly identical to the original code, up to minor details. As an example, if the copy-pasted code has all references to variable 'a' replaced with references to variable 'b', it is still considered to be an exact clone. The new check finds copy-pasted code in which exactly one variable seems out of place compared to the original code, which likely indicates a copy-paste error (a variable was forgotten to be renamed in one place). Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23314 llvm-svn: 279056
* revert [analyzer] Added valist related checkers.Gabor Horvath2016-08-183-341/+0
| | | | llvm-svn: 279043
* [analyzer] Added valist related checkers.Gabor Horvath2016-08-183-0/+341
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279041
* [analyzer] Add a checker for loss of sign or precision in integral casts.Artem Dergachev2016-08-171-0/+125
| | | | | | | | | | | | | | | This new checker tries to find execution paths on which implicit integral casts cause definite loss of information: a certainly-negative integer is converted to an unsigned integer, or an integer is definitely truncated to fit into a smaller type. Being implicit, such casts are likely to produce unexpected results. Patch by Daniel Marjamäki! Differential Revision: https://reviews.llvm.org/D13126 llvm-svn: 278941
* [analyzer] Add LocationContext information to SymbolMetadata.Artem Dergachev2016-08-171-0/+17
| | | | | | | | | | | | | | | | | | | | | Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 llvm-svn: 278937
* StaticAnalyzer: Report found fields order in PaddingCheckerSaleem Abdulrasool2016-08-151-20/+146
| | | | | | | | Report the found fields order in PaddingChecker. Patch by Alexander Shaposhnikov! llvm-svn: 278730
* [analyzer] Teach RetainCountChecker about CVFooRetainDevin Coughlin2016-08-111-0/+20
| | | | | | | | | | | | Change the retain count checker to treat CoreFoundation-style "CV"-prefixed reference types from CoreVideo similarly to CoreGraphics types. With this change, we treat CVFooRetain() on a CVFooRef type as a retain. CVFooRelease() APIs are annotated as consuming their parameter, so this change prevents false positives about incorrect decrements of reference counts. <rdar://problem/27116090> llvm-svn: 278382
* [analyzer] Fix a crash in CloneDetector when calling functions by pointers.Artem Dergachev2016-08-101-0/+12
| | | | | | | | | | | CallExpr may have a null direct callee when the callee function is not known in compile-time. Do not try to take callee name in this case. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23320 llvm-svn: 278238
* [analyzer] Change -analyze-function to accept qualified names.Artem Dergachev2016-08-084-27/+61
| | | | | | | | | | | | | | | Both -analyze-function and -analyzer-display-progress now share the same convention for naming functions, which allows discriminating between methods with the same name in different classes, C++ overloads, and also presents Objective-C instance and class methods in the convenient notation. This also allows looking up the name for the particular function you're trying to restrict analysis to in the -analyzer-display-progress output, in case it was not instantly obvious. Differential Revision: https://reviews.llvm.org/D22856 llvm-svn: 278018
* [analyzer] Command line option to show enabled checker list.Gabor Horvath2016-08-081-0/+20
| | | | | | | | | | | | This patch adds a command line option to list the checkers that were enabled by analyzer-checker and not disabled by -analyzer-disable-checker. It can be very useful to debug long command lines when it is not immediately apparent which checkers are turned on and which checkers are turned off. Differential Revision: https://reviews.llvm.org/D23060 llvm-svn: 278006
* [analyzer] Model base to derived casts more precisely.Gabor Horvath2016-08-081-0/+16
| | | | | | | | | | | | | | Dynamic casts are handled relatively well by the static analyzer. BaseToDerived casts however are treated conservatively. This can cause some false positives with the NewDeleteLeaks checker. This patch alters the behavior of BaseToDerived casts. In case a dynamic cast would succeed use the same semantics. Otherwise fall back to the conservative approach. Differential Revision: https://reviews.llvm.org/D23014 llvm-svn: 277989
* [analyzer] Make CloneDetector recognize different variable patterns.Artem Dergachev2016-08-042-22/+9
| | | | | | | | | | | | | | | | | CloneDetector should be able to detect clones with renamed variables. However, if variables are referenced multiple times around the code sample, the usage patterns need to be recognized. For example, (x < y ? y : x) and (y < x ? y : x) are no longer clones, however (a < b ? b : a) is still a clone of the former. Variable patterns are computed and compared during a separate filtering pass. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22982 llvm-svn: 277757
* [analyzer] Hotfix for buildbot failure due to unspecified triple in r277449Artem Dergachev2016-08-021-1/+1
| | | | | | | | | If a target triple is not specified, the default host triple is used, which is not good for compiling inline assembler code. Patch by Raphael Isemann! llvm-svn: 277473
* [analyzer] Respect statement-specific data in CloneDetection.Artem Dergachev2016-08-0214-8/+364
| | | | | | | | | | | | | | | | | So far the CloneDetector only respected the kind of each statement when searching for clones. This patch refines the way the CloneDetector collects data from each statement by providing methods for each statement kind, that will read the kind-specific attributes. For example, statements 'a < b' and 'a > b' are no longer considered to be clones, because they are different in operation code, which is an attribute specific to the BinaryOperator statement kind. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D22514 llvm-svn: 277449
* [analyzer] Add basic capabilities to detect source code clones.Artem Dergachev2016-07-265-0/+127
| | | | | | | | | | | | | | | | | | | | | This patch adds the CloneDetector class which allows searching source code for clones. For every statement or group of statements within a compound statement, CloneDetector computes a hash value, and finds clones by detecting identical hash values. This initial patch only provides a simple hashing mechanism that hashes the kind of each sub-statement. This patch also adds CloneChecker - a simple static analyzer checker that uses CloneDetector to report copy-pasted code. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D20795 llvm-svn: 276782
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-211-0/+89
| | | | | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). This reapplies r275820 after fixing a string-lifetime issue discovered by the bots. A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 276365
OpenPOWER on IntegriCloud