summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Add analyzer option to limit the number of imported TUsEndre Fulop2019-07-082-1/+7
| | | | | | | | | | | | Summary: During CTU analysis of complex projects, the loaded AST-contents of imported TUs can grow bigger than available system memory. This option introduces a threshold on the number of TUs to be imported for a single TU in order to prevent such cases. Differential Revision: https://reviews.llvm.org/D59798 llvm-svn: 365314
* [analyzer] Add a debug analyzer config to place an event for each tracked ↵Kristof Umann2019-07-052-7/+39
| | | | | | | | condition Differential Revision: https://reviews.llvm.org/D63642 llvm-svn: 365208
* [analyzer] Track terminator conditions on which a tracked expression dependsKristof Umann2019-07-052-1/+287
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a major part of my GSoC project, aimed to improve the bug reports of the analyzer. TL;DR: Help the analyzer understand that some conditions are important, and should be explained better. If an CFGBlock is a control dependency of a block where an expression value is tracked, explain the condition expression better by tracking it. if (A) // let's explain why we believe A to be true 10 / x; // division by zero This is an experimental feature, and can be enabled by the off-by-default analyzer configuration "track-conditions". In detail: This idea was inspired by the program slicing algorithm. Essentially, two things are used to produce a program slice (a subset of the program relevant to a (statement, variable) pair): data and control dependencies. The bug path (the linear path in the ExplodedGraph that leads from the beginning of the analysis to the error node) enables to analyzer to argue about data dependencies with relative ease. Control dependencies are a different slice of the cake entirely. Just because we reached a branch during symbolic execution, it doesn't mean that that particular branch has any effect on whether the bug would've occured. This means that we can't simply rely on the bug path to gather control dependencies. In previous patches, LLVM's IDFCalculator, which works on a control flow graph rather than the ExplodedGraph was generalized to solve this issue. We use this information to heuristically guess that the value of a tracked expression depends greatly on it's control dependencies, and start tracking them as well. After plenty of evaluations this was seen as great idea, but still lacking refinements (we should have different descriptions about a conditions value), hence it's off-by-default. Differential Revision: https://reviews.llvm.org/D62883 llvm-svn: 365207
* [analyzer][IDF] Add a control dependency calculator + a new debug checkerKristof Umann2019-07-052-19/+94
| | | | | | | | | | | | | | | | | | | | | | | I intend to improve the analyzer's bug reports by tracking condition expressions. 01 bool b = messyComputation(); 02 int i = 0; 03 if (b) // control dependency of the bug site, let's explain why we assume val 04 // to be true 05 10 / i; // warn: division by zero I'll detail this heuristic in the followup patch, strictly related to this one however: * Create the new ControlDependencyCalculator class that uses llvm::IDFCalculator to (lazily) calculate control dependencies for Clang's CFG. * A new debug checker debug.DumpControlDependencies is added for lit tests * Add unittests Differential Revision: https://reviews.llvm.org/D62619 llvm-svn: 365197
* [CTU] Add support for virtual functionsGabor Marton2019-07-043-1/+30
| | | | | | | | | | | | Reviewers: Szelethus, xazax.hun Subscribers: rnkovacs, dkrupp, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63920 llvm-svn: 365133
* [analyzer] ReturnValueChecker: Model the guaranteed boolean return value of ↵Csaba Dabis2019-07-041-0/+91
| | | | | | | | | | | | | | | | | | | function calls Summary: It models the known LLVM methods paired with their class. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: dschuff, aheejin, mgorny, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63915 llvm-svn: 365103
* [analyzer] exploded-graph-rewriter: Implement a black-and-white color scheme.Artem Dergachev2019-07-031-5/+12
| | | | | | | | For accessibility! Differential Revision: https://reviews.llvm.org/D64153 llvm-svn: 365085
* [analyzer][Dominator] Add post dominators to CFG + a new debug checkerKristof Umann2019-07-032-0/+71
| | | | | | | | | | | | | | | | Transform clang::DominatorTree to be able to also calculate post dominators. * Tidy up the documentation * Make it clang::DominatorTree template class (similarly to how llvm::DominatorTreeBase works), rename it to clang::CFGDominatorTreeImpl * Clang's dominator tree is now called clang::CFGDomTree * Clang's brand new post dominator tree is called clang::CFGPostDomTree * Add a lot of asserts to the dump() function * Create a new checker to test the functionality Differential Revision: https://reviews.llvm.org/D62551 llvm-svn: 365028
* [Dominators] PR42041: Skip nullpointer successorsKristof Umann2019-07-032-62/+157
| | | | | | | | | | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=42041 In Clang's CFG, we use nullpointers to represent unreachable nodes, for example, in the included testfile, block B0 is unreachable from block B1, resulting in a nullpointer dereference somewhere in llvm::DominatorTreeBase<clang::CFGBlock, false>::recalculate. This patch fixes this issue by specializing llvm::DomTreeBuilder::SemiNCAInfo::ChildrenGetter::Get for clang::CFG to not contain nullpointer successors. Differential Revision: https://reviews.llvm.org/D62507 llvm-svn: 365026
* [analyzer] exploded-graph-rewriter: Implement bug nodes and sink nodes.Artem Dergachev2019-07-0312-7/+54
| | | | | | | | | | | Add a label to nodes that have a bug report attached or on which the analysis was generally interrupted. Fix printing has_report and implement printing is_sink in the graph dumper. Differential Revision: https://reviews.llvm.org/D64110 llvm-svn: 364992
* [analyzer] exploded-graph-rewriter: Collapse very long statement pretty-prints.Artem Dergachev2019-07-031-0/+24
| | | | | | | | | | When printing various statements that include braces (compound statements, lambda expressions, statement-expressions, etc.), replace the code between braces with '...'. Differential Revision: https://reviews.llvm.org/D64104 llvm-svn: 364990
* [analyzer] exploded-graph-rewriter: Implement checker messages.Artem Dergachev2019-07-038-1/+135
| | | | | | | | They are displayed as raw lines and diffed via difflib on a per-checker basis. Differential Revision: https://reviews.llvm.org/D64100 llvm-svn: 364989
* [analyzer] exploded-graph-rewriter: Implement a dark color scheme.Artem Dergachev2019-07-025-4/+31
| | | | | | | | Addresses a popular request. Activated via --dark. Differential Revision: https://reviews.llvm.org/D64056 llvm-svn: 364882
* [analyzer] exploded-graph-rewriter: Improve program point dumps.Artem Dergachev2019-07-022-6/+28
| | | | | | | | | | | | - Take advantage of the stmt_point_kind. - Dump block IDs for BlockEntrance nodes. - Don't dump huge compound statements on PurgeDeadSymbols nodes. - Rename Edge to BlockEdge for consistency. - Tweak colors. Differential Revision: https://reviews.llvm.org/D64051 llvm-svn: 364881
* [analyzer] exploded-graph-rewriter: Add support for objects under construction.Artem Dergachev2019-07-028-1/+85
| | | | | | | | This trait is Environment-like, so there was a chance to re-use a lot of code. Differential Revision: https://reviews.llvm.org/D64047 llvm-svn: 364880
* [analyzer] Support kfree in MallocCheckerNathan Huckleberry2019-07-011-3/+3
| | | | | | | | | | | | | | | | | | | Summary: kmalloc is freed with kfree in the linux kernel. kmalloc support was added in r204832, but kfree was not. Adding kfree fixes incorrectly detected memory leaks. Reviewers: NoQ, nickdesaulniers, dcoughlin, Szelethus Reviewed By: NoQ, Szelethus Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64030 llvm-svn: 364875
* [analyzer] exploded-graph-rewriter: NFC: Add a forgotten test file.Artem Dergachev2019-07-011-0/+21
| | | | | | This fell off of r364865. llvm-svn: 364871
* [analyzer] Fix invalidation when returning into a ctor initializer.Artem Dergachev2019-07-011-0/+25
| | | | | | | | | | | | | | Due to RVO the target region of a function that returns an object by value isn't necessarily a temporary object region; it may be an arbitrary memory region. In particular, it may be a field of a bigger object. Make sure we don't invalidate the bigger object when said function is evaluated conservatively. Differential Revision: https://reviews.llvm.org/D63968 llvm-svn: 364870
* [analyzer] NonnullGlobalConstants: Don't be confused by a _Nonnull attribute.Artem Dergachev2019-07-011-0/+12
| | | | | | | | | | | | | | | The NonnullGlobalConstants checker models the rule "it doesn't make sense to make a constant global pointer and initialize it to null"; it makes sure that whatever it's initialized with is known to be non-null. Ironically, annotating the type of the pointer as _Nonnull breaks the checker. Fix handling of the _Nonnull annotation so that it was instead one more reason to believe that the value is non-null. Differential Revision: https://reviews.llvm.org/D63956 llvm-svn: 364869
* [analyzer] CStringChecker: Modernize to use CallDescriptions.Artem Dergachev2019-07-011-0/+6
| | | | | | | | | | | | | This patch uses the new CDF_MaybeBuiltin flag to handle C library functions. It's mostly an NFC/refactoring pass, but it does fix a bug in handling memset() when it expands to __builtin___memset_chk() because the latter has one more argument and memset() handling code was trying to match the exact number of arguments. Now the code is deduplicated and there's less room for mistakes. Differential Revision: https://reviews.llvm.org/D62557 llvm-svn: 364868
* [analyzer] exploded-graph-rewriter: Add support for dynamic types.Artem Dergachev2019-07-016-1/+12
| | | | | | | | | Slightly cleanup emission of horizontal lines and unhardcode the title for generic maps. Differential Revision: https://reviews.llvm.org/D64041 llvm-svn: 364865
* [analyzer] exploded-graph-rewriter: Implement program point tags.Artem Dergachev2019-07-011-1/+9
| | | | | | | | Keep them on a separate line for more visibility. Differential Revision: https://reviews.llvm.org/D63965 llvm-svn: 364864
* [analyzer] Fix clang-tidy crash on GCCAsmStmtNathan Huckleberry2019-06-271-0/+26
| | | | | | | | | | | | | | | | | | | | Summary: Added entry in switch statement to recognize GCCAsmStmt as a possible block terminator. Handling to build CFG using GCCAsmStmt was already implemented. Reviewers: nickdesaulniers, george.karpenkov, NoQ Reviewed By: nickdesaulniers, NoQ Subscribers: xbolva00, tmroeder, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63533 llvm-svn: 364605
* [analyzer] exploded-graph-rewriter: Prettier location context dumps.Artem Dergachev2019-06-261-1/+1
| | | | | | Make them span wider. llvm-svn: 364365
* [analyzer] print() JSONify: Create pointersCsaba Dabis2019-06-255-103/+124
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63726 llvm-svn: 364271
* [analyzer] JsonSupport: Escape escapesCsaba Dabis2019-06-252-2/+6
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63462 llvm-svn: 364270
* [analyzer] exploded-graph-rewriter: Fix escaping for bitwise-or.Artem Dergachev2019-06-251-1/+6
| | | | | | | '|' is a special character in graphviz, so it needs to be properly escaped and unescaped. llvm-svn: 364269
* [analyzer] exploded-graph-rewriter: Add support for range constraints.Artem Dergachev2019-06-256-0/+99
| | | | | | | | | | | | Diff support included. A cheap solution is implemented that treats range constraints as "some sort of key-value map", so it's going to be trivial to add support for other such maps later, such as dynamic type info. Differential Revision: https://reviews.llvm.org/D63685 llvm-svn: 364268
* [cxx2a] P1236R1: the validity of a left shift does not depend on theRichard Smith2019-06-251-0/+22
| | | | | | value of the LHS operand. llvm-svn: 364265
* [analyzer] ExprEngine: Escape pointers in bitwise operationsCsaba Dabis2019-06-251-0/+33
| | | | | | | | | | | | | | | | | | Summary: After evaluation it would be an Unknown value and tracking would be lost. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63720 llvm-svn: 364259
* [analyzer] print() JSONify: ProgramPoint revisionCsaba Dabis2019-06-241-0/+2
| | | | | | | | | | | | | | | | | Summary: Now we also print out the filename with its path. Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63438 llvm-svn: 364197
* [analyzer] Fix JSON dumps for ExplodedNodesCsaba Dabis2019-06-241-4/+8
| | | | | | | | | | | | | | | | | | | Summary: - Now we could see the `has_report` property in `trim-egraph` mode. - This patch also removes the trailing comma after each node. Reviewers: NoQ Reviewed By: NoQ Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63436 llvm-svn: 364193
* [analyzer] DeadStores: Update the crude suppression for files generated by IIG.Artem Dergachev2019-06-201-1/+1
| | | | | | They changed the comments that we were looking for. llvm-svn: 363995
* [Testing] Dumping the graph requires assertions be enabledDavid Zarzycki2019-06-201-0/+1
| | | | llvm-svn: 363916
* [analyzer] exploded-graph-rewriter: Implement a --diff mode.Artem Dergachev2019-06-194-1/+193
| | | | | | | | | | | | | | | | | | | | | In this mode the tool would avoid duplicating the contents of the program state on every node, replacing them with a diff-like dump of changes that happened on that node. This is useful because most of the time we only interested in whether the effect of the statement was modeled correctly. A diffed graph would also be much faster to load and navigate, being much smaller than the original graph. The diffs are computed "semantically" as opposed to plain text diffs. I.e., the diff algorithm is hand-crafted separately for every state trait, taking the underlying data structures into account. This is especially nice for Environment because textual diffs would have been terrible. On the other hand, it requires some boilerplate to implement. Differential Revision: https://reviews.llvm.org/D62761 llvm-svn: 363898
* [analyzer] exploded-graph-rewriter: Fix escaping StringRegions.Artem Dergachev2019-06-192-1/+19
| | | | | | | | | | | Quotes around StringRegions are now escaped and unescaped correctly, producing valid JSON. Additionally, add a forgotten escape for Store values. Differential Revision: https://reviews.llvm.org/D63519 llvm-svn: 363897
* [analyzer] Fix JSON dumps for store clusters.Artem Dergachev2019-06-192-2/+2
| | | | | | | | | | Include a unique pointer so that it was possible to figure out if it's the same cluster in different program states. This allows comparing dumps of different states against each other. Differential Revision: https://reviews.llvm.org/D63362 llvm-svn: 363896
* [analyzer] Fix JSON dumps for location contexts.Artem Dergachev2019-06-192-4/+4
| | | | | | | | | | | Location context ID is a property of the location context, not of an item within it. It's useful to know the id even when there are no items in the context, eg. for the purposes of figuring out how did contents of the Environment for the same location context changed across states. Differential Revision: https://reviews.llvm.org/D62754 llvm-svn: 363895
* [analyzer] Fix JSON dumps for dynamic type information.Artem Dergachev2019-06-191-1/+4
| | | | | | | | They're now valid JSON. Differential Revision: https://reviews.llvm.org/D62716 llvm-svn: 363894
* [analyzer] DeadStores: Add a crude suppression files generated by DriverKit IIG.Artem Dergachev2019-06-192-0/+32
| | | | | | | | | | | | IIG is a replacement for MIG in DriverKit: IIG is autogenerating C++ code. Suppress dead store warnings on such code, as the tool seems to be producing them regularly, and the users of IIG are not in position to address these warnings, as they don't control the autogenerated code. IIG-generated code is identified by looking at the comments at the top of the file. Differential Revision: https://reviews.llvm.org/D63118 llvm-svn: 363892
* [analyzer] RetainCount: Add support for OSRequiredCast().Artem Dergachev2019-06-192-1/+24
| | | | | | | | | | | | | | It's a new API for custom RTTI in Apple IOKit/DriverKit framework that is similar to OSDynamicCast() that's already supported, but crashes instead of returning null (and therefore causing UB when the cast fails unexpectedly). Kind of like cast_or_null<> as opposed to dyn_cast_or_null<> in LLVM's RTTI. Historically, RetainCountChecker was responsible for modeling OSDynamicCast. This is simply an extension of the same functionality. Differential Revision: https://reviews.llvm.org/D63117 llvm-svn: 363891
* [analyzer] SARIF: Add EOF newline; replace diff_sarifHubert Tong2019-06-195-7/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This patch applies a change similar to rC363069, but for SARIF files. The `%diff_sarif` lit substitution invokes `diff` with a non-portable `-I` option. The intended effect can be achieved by normalizing the inputs to `diff` beforehand. Such normalization can be done with `grep -Ev`, which is also used by other tests. Additionally, this patch updates the SARIF output to have a newline at the end of the file. This makes it so that the SARIF file qualifies as a POSIX text file, which increases the consumability of the generated file in relation to various tools. Reviewers: NoQ, sfertile, xingxue, jasonliu, daltenty, aaron.ballman Reviewed By: aaron.ballman Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, jsji, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D62952 llvm-svn: 363822
* [analyzer][NFC][tests] Pre-normalize expected-sarif filesHubert Tong2019-06-192-20/+0
| | | | | | | | As discussed in the review for D62952, this patch pre-normalizes the reference expected output sarif files by removing lines containing fields for which we expect differences that should be ignored. llvm-svn: 363788
* [analyzer] ReturnVisitor: more portable test caseCsaba Dabis2019-06-161-2/+1
| | | | llvm-svn: 363515
* [analyzer] Push correct version of 'Track indices of arrays'Kristof Umann2019-06-161-4/+43
| | | | | | Messed up the commit, oops. llvm-svn: 363512
* [analyzer] Track indices of arraysKristof Umann2019-06-161-0/+25
| | | | | | | | | | | | Often times, when an ArraySubscriptExpr was reported as null or undefined, the bug report was difficult to understand, because the analyzer explained why arr[i] has that value, but didn't realize that in fact i's value is very important as well. This patch fixes this by tracking the indices of arrays. Differential Revision: https://reviews.llvm.org/D63080 llvm-svn: 363510
* [analyzer] ReturnVisitor: Bypass everything to see inlined callsCsaba Dabis2019-06-153-4/+172
| | | | | | | | | | | | | | | | | | | | Summary: When we traversed backwards on ExplodedNodes to see where processed the given statement we `break` too early. With the current approach we do not miss the CallExitEnd ProgramPoint which stands for an inlined call. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D62926 llvm-svn: 363491
* PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of typeRichard Smith2019-06-141-10/+2
| | | | | | | | | | | nullptr_t does not access memory. We now reuse CK_NullToPointer to represent a conversion from a glvalue of type nullptr_t to a prvalue of nullptr_t where necessary. This reinstates r363337, reverted in r363352. llvm-svn: 363429
* Revert 363295, it caused PR42276. Also revert follow-ups 363337, 363340.Nico Weber2019-06-141-2/+10
| | | | | | | | Revert 363340 "Remove unused SK_LValueToRValue initialization step." Revert 363337 "PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of type" Revert 363295 "C++ DR712 and others: handle non-odr-use resulting from an lvalue-to-rvalue conversion applied to a member access or similar not-quite-trivial lvalue expression." llvm-svn: 363352
* PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of typeRichard Smith2019-06-131-10/+2
| | | | | | | | | | | | nullptr_t does not access memory. We now reuse CK_NullToPointer to represent a conversion from a glvalue of type nullptr_t to a prvalue of nullptr_t where necessary. This reinstates r345562, reverted in r346065, now that CodeGen's handling of non-odr-used variables has been fixed. llvm-svn: 363337
OpenPOWER on IntegriCloud