summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Track non-zero values in ReturnVisitorGeorge Karpenkov2018-08-222-4/+25
| | | | | | | | | | | | | Tracking those can help to provide much better diagnostics in many cases. In general, most of the visitor machinery should be refactored to allow tracking the origin of arbitrary values. rdar://36039765 Differential Revision: https://reviews.llvm.org/D51131 llvm-svn: 340475
* [analyzer][UninitializedObjectChecker] Explicit namespace resolution for ↵Kristof Umann2018-08-211-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | inherited data members For the following example: struct Base { int x; }; // In a different translation unit struct Derived : public Base { Derived() {} }; For a call to Derived::Derived(), we'll receive a note that this->x is uninitialized. Since x is not a direct field of Derived, it could be a little confusing. This patch aims to fix this, as well as the case when the derived object has a field that has the name as an inherited uninitialized data member: struct Base { int x; // note: uninitialized field 'this->Base::x' }; struct Derived : public Base { int x = 5; Derived() {} }; Differential Revision: https://reviews.llvm.org/D50905 llvm-svn: 340272
* [analyzer][UninitializedObjectChecker] Refactoring p6.: Move dereferencing ↵Kristof Umann2018-08-211-4/+17
| | | | | | | | | | | | to a function Now that it has it's own file, it makes little sense for isPointerOrReferenceUninit to be this large, so I moved dereferencing to a separate function. Differential Revision: https://reviews.llvm.org/D50509 llvm-svn: 340265
* [analyzer] Re-instate support for MakeCollectable is RetainCountCheckerGeorge Karpenkov2018-08-173-517/+652
| | | | | | Differential Revision: https://reviews.llvm.org/D50872 llvm-svn: 340097
* [analyzer] Drop support for GC mode in RetainCountCheckerGeorge Karpenkov2018-08-178-2633/+518
| | | | | | | | | | | | A lot of code in RetainCountChecker deals with GC mode. Given that GC mode is deprecated, Apple does not ship runtime for it, and modern compiler toolchain does not support it, it makes sense to remove the code dealing with it in order to aid understanding of RetainCountChecker. Differential Revision: https://reviews.llvm.org/D50747 llvm-svn: 340091
* [CStringSyntaxChecker] Reduces space around error message for strlcat.David Carlier2018-08-151-1/+1
| | | | llvm-svn: 339808
* [analyzer] Add support for constructors of arguments.Artem Dergachev2018-08-153-17/+234
| | | | | | | | | | | | | | | | | | | | | Once CFG-side support for argument construction contexts landed in r338436, the analyzer could make use of them to evaluate argument constructors properly. When evaluated as calls, constructors of arguments now use the variable region of the parameter as their target. The corresponding stack frame does not yet exist when the parameter is constructed, and this stack frame is created eagerly. Construction of functions whose body is unavailable and of virtual functions is not yet supported. Part of the reason is the analyzer doesn't consistently use canonical declarations o identify the function in these cases, and every re-declaration or potential override comes with its own set of parameter declarations. Also it is less important because if the function is not inlined, there's usually no benefit in inlining the argument constructor. Differential Revision: https://reviews.llvm.org/D49443 llvm-svn: 339745
* [CFG] [analyzer] Find argument constructors in CXXTemporaryObjectExprs.Artem Dergachev2018-08-141-0/+33
| | | | | | | | | | | CXXTemporaryObjectExpr is a sub-class of CXXConstructExpr. If it has arguments that are structures passed by value, their respective constructors need to be handled by providing a ConstructionContext, like for regular function calls and for regular constructors. Differential Revision: https://reviews.llvm.org/D50487 llvm-svn: 339727
* [analyzer] Add a test forgotten in r339088.Artem Dergachev2018-08-141-0/+17
| | | | | | Differential Revision: https://reviews.llvm.org/D50363 llvm-svn: 339726
* [analyzer][UninitializedObjectChecker] Void pointers are casted back to ↵Kristof Umann2018-08-141-6/+6
| | | | | | | | their dynamic type in note message Differential Revision: https://reviews.llvm.org/D49228 llvm-svn: 339653
* [CStringSyntaxChecker] Check strlcat sizeof checkDavid Carlier2018-08-141-0/+17
| | | | | | | | | | | | | - Assuming strlcat is used with strlcpy we check as we can if the last argument does not equal os not larger than the buffer. - Advising the proper usual pattern. Reviewers: NoQ, george.karpenkov Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D49722 llvm-svn: 339641
* Move test inputs into Inputs directory.Richard Smith2018-08-1461-28/+28
| | | | | | | We don't need a new ExpectedOutputs/ convention. Expected outputs are just another form of test input. llvm-svn: 339634
* [analyzer] Fix UninitializedObjectChecker to not crash on uninitialized "id" ↵George Karpenkov2018-08-131-0/+10
| | | | | | | | fields Differential Revision: https://reviews.llvm.org/D50673 llvm-svn: 339631
* [analyzer] [NFC] Introduce separate targets for testing the analyzer: ↵George Karpenkov2018-08-132-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | check-clang-analyzer and check-clang-analyzer-z3 Current testing setup for analyzer tests with Z3 is rather inconvenient: There's no way to run the analyzer tests separately (I use LIT_FILTER=Analysis ninja check-clang, but a direct target is nicer). When Clang is built with Z3 support, there's no way to *not* run tests with Z3 solver, and this is often desired, as tests with Z3 solver take a very long time. This patch introduces two extra targets: - check-clang-analyzer - check-clang-analyzer-z3 which solve those problems. Differential Revision: https://reviews.llvm.org/D50594 llvm-svn: 339629
* [analyzer][UninitializedObjectChecker] Refactoring p4.: Wrap FieldRegions ↵Kristof Umann2018-08-132-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and reduce weight on FieldChainInfo Before this patch, FieldChainInfo used a spaghetti: it took care of way too many cases, even though it was always meant as a lightweight wrapper around ImmutableList<const FieldRegion *>. This problem is solved by introducing a lightweight polymorphic wrapper around const FieldRegion *, FieldNode. It is an interface that abstracts away special cases like pointers/references, objects that need to be casted to another type for a proper note messages. Changes to FieldChainInfo: * Now wraps ImmutableList<const FieldNode &>. * Any pointer/reference related fields and methods were removed * Got a new add method. This replaces it's former constructors as a way to create a new FieldChainInfo objects with a new element. Changes to FindUninitializedField: * In order not to deal with dynamic memory management, when an uninitialized field is found, the note message for it is constructed and is stored instead of a FieldChainInfo object. (see doc around addFieldToUninits). Some of the test files are changed too, from now on uninitialized pointees of references always print "uninitialized pointee" instead of "uninitialized field" (which should've really been like this from the beginning). I also updated every comment according to these changes. Differential Revision: https://reviews.llvm.org/D50506 llvm-svn: 339599
* [analyzer] InnerPointerChecker: improve warning messages and notes.Reka Kovacs2018-08-101-114/+146
| | | | | | Differential Revision: https://reviews.llvm.org/D49570 llvm-svn: 339489
* [analyzer] [NFC] [tests] Move plist-based diagnostics tests to separate ↵George Karpenkov2018-08-109-4313/+4330
| | | | | | | | | | files, use diff instead of a FileCheck - II Some files were missed by https://reviews.llvm.org/D50545 Differential Revision: https://reviews.llvm.org/D50590 llvm-svn: 339488
* [analyzer] Record nullability implications on getting items from NSDictionaryGeorge Karpenkov2018-08-102-1/+155
| | | | | | | | | | | | | | | | | | | | If we get an item from a dictionary, we know that the item is non-null if and only if the key is non-null. This patch is a rather hacky way to record this implication, because some logic needs to be duplicated from the solver. And yet, it's pretty simple, performant, and works. Other possible approaches: - Record the implication, in future rely on Z3 to pick it up. - Generalize the current code and move it to the constraint manager. rdar://34990742 Differential Revision: https://reviews.llvm.org/D50124 llvm-svn: 339482
* [analyzer] Fix tracking expressions through negation operatorGeorge Karpenkov2018-08-101-0/+15
| | | | | | Differential Revision: https://reviews.llvm.org/D50537 llvm-svn: 339476
* [analyzer] [NFC] [tests] Move plist-based diagnostics tests to separate ↵George Karpenkov2018-08-1052-63183/+67351
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files, use diff instead of a FileCheck Some of the analyzer tests check the exact plist output, in order to verify that the diagnostics produced is correct. Current testing setup has many issues: plist output clobbers tests, making them harder to read it is impossible to debug test failures given error messages from FileCheck. The only recourse is manually creating the files and using the diff again, it is impossible to update the tests given the error message: the only process is a tedious manual one, going from a separate plist file to CHECK directives. This patch offers a much better approach of using "diff" directly in place of FileCheck, and moving tests to separate files. Generated using the following script: ``` import os import glob import re import subprocess diagnostics_key = "// CHECK: <key>diagnostics</key>" def process_file(f, data): idx = data.index(diagnostics_key) plist_out_f = 'ExpectedOutputs/plists/%s.plist' % f plist_out_folder = os.path.join('ExpectedOutputs/plists/', os.path.dirname(f)) plist_data = data[idx:] plist_data = plist_data.replace('// CHECK: ', '') plist_data = plist_data.replace('// CHECK-NEXT: ', '') plist_data += "</dict>\n</plist>\n" data = data[:idx] ptn = re.compile("FileCheck --?input-file(=| )(%t|%t\.plist) %s") if not ptn.findall(data): print "none found =/ skipping..." return data = ptn.sub(lambda m: "tail -n +11 %s | diff -u -w - %%S/../%s" % (m.group(2), plist_out_f), data) with open(f, 'w') as out_f: out_f.write(data) subprocess.check_call(["mkdir", "-p", plist_out_folder]) with open(plist_out_f, 'w') as out_f: out_f.write(plist_data) def main(): files = glob.glob("**/*.*") for f in files: with open(f) as f_handler: data = f_handler.read() if diagnostics_key in data: print "Converting %s" %f process_file(f, data) if __name__ == "__main__": main() ``` Differential Revision: https://reviews.llvm.org/D50545 llvm-svn: 339475
* Invalidate static locals when escaping lambdasGeorge Karpenkov2018-08-101-0/+30
| | | | | | | | | | Lambdas can affect static locals even without an explicit capture. rdar://39537031 Differential Revision: https://reviews.llvm.org/D50368 llvm-svn: 339459
* [analyzer] Fix the bug in UninitializedObjectChecker caused by not handling ↵George Karpenkov2018-08-091-0/+22
| | | | | | | | block pointers Differential Revision: https://reviews.llvm.org/D50523 llvm-svn: 339369
* [analyzer][UninitializedObjectChecker] Pointer/reference objects are ↵Kristof Umann2018-08-082-2/+74
| | | | | | | | | | | | | | | | dereferenced according to dynamic type This patch fixed an issue where the dynamic type of pointer/reference object was known by the analyzer, but wasn't obtained in the checker, which resulted in false negatives. This should also increase reliability of the checker, as derefencing is always done now according to the dynamic type (even if that happens to be the same as the static type). Special thanks to Artem Degrachev for setting me on the right track. Differential Revision: https://reviews.llvm.org/D49199 llvm-svn: 339240
* [analyzer][UninitializedObjectChecker] Fixed a false negative by no longer ↵Kristof Umann2018-08-081-4/+3
| | | | | | | | | | | | | | | | | filtering out certain constructor calls As of now, all constructor calls are ignored that are being called by a constructor. The point of this was not to analyze the fields of an object, so an uninitialized field wouldn't be reported multiple times. This however introduced false negatives when the two constructors were in no relation to one another -- see the test file for a neat example for this with singletons. This patch aims so fix this issue. Differential Revision: https://reviews.llvm.org/D48436 llvm-svn: 339237
* [analyzer] Avoid querying this-pointers for static-methods.Matt Davis2018-08-071-0/+12
| | | | | | | | | | | | | | | | | | | Summary: The loop-widening code processes c++ methods looking for `this` pointers. In the case of static methods (which do not have `this` pointers), an assertion was triggering. This patch avoids trying to process `this` pointers for static methods, and thus avoids triggering the assertion . Reviewers: dcoughlin, george.karpenkov, NoQ Reviewed By: NoQ Subscribers: NoQ, xazax.hun, szepet, a.sidorin, mikhail.ramalho, cfe-commits Differential Revision: https://reviews.llvm.org/D50408 llvm-svn: 339201
* [analyzer][UninitializedObjectChecker] New flag to turn off dereferencingKristof Umann2018-08-075-8/+51
| | | | | | | | | | | Even for a checker being in alpha, some reports about pointees held so little value to the user that it's safer to disable pointer/reference chasing for now. It can be enabled with a new flag, in which case checker should function as it has always been. This can be set with `CheckPointeeInitialization`. Differential Revision: https://reviews.llvm.org/D49438 llvm-svn: 339135
* [analyzer] pr37204: Take signedness into account in getTruthValue().Artem Dergachev2018-08-071-0/+6
| | | | | | | | | | | It now actually produces a signed APSInt when the QualType passed into it is signed, which is what any caller would expect. Fixes a couple of crashes. Differential Revision: https://reviews.llvm.org/D50363 llvm-svn: 339088
* [analyzer] NFC: Document that we support implicit argument constructors.Artem Dergachev2018-08-072-0/+50
| | | | | | | | | | | | | | The change in the AST in r338135 caused us to accidentally support inlining constructors of operator implicit arguments. Previously they were hard to support because they were treated as arguments in expressions but not in declarations, but now they can be transparently treated as simple temporaries. Add tests and comments to explain how it now works. Differential Revision: https://reviews.llvm.org/D49627 llvm-svn: 339087
* [analyzer] Do not crash in NoStoreFuncVisitor notes if an unexpected region ↵George Karpenkov2018-08-031-0/+24
| | | | | | | | is found. Just do not generate the note at all in that case. llvm-svn: 338935
* [analyzer] Add test for a crash fixed in r338775.Reka Kovacs2018-08-031-0/+10
| | | | | | | | Do not crash if a CXXRecordDecl cannot be obtained for an object. Special thanks for the reproduction to Alexander Kornienko. llvm-svn: 338918
* [analyzer] Detect pointers escaped after ReturnStmt execution in MallocChecker.Reka Kovacs2018-08-022-0/+42
| | | | | | | | | | Objects local to a function are destroyed right after the statement returning (part of) them is executed in the analyzer. This patch enables MallocChecker to warn in these cases. Differential Revision: https://reviews.llvm.org/D49361 llvm-svn: 338780
* [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.Reka Kovacs2018-08-021-0/+34
| | | | | | | | | | | The CoreEngine only gives us a ReturnStmt if the last element in the CFGBlock is a CFGStmt, otherwise the ReturnStmt is nullptr. This patch adds support for the case when the last element is a CFGAutomaticObjDtor, by returning its TriggerStmt as a ReturnStmt. Differential Revision: https://reviews.llvm.org/D49811 llvm-svn: 338777
* [analyzer] Fix tests.George Karpenkov2018-08-022-2/+4
| | | | llvm-svn: 338756
* [analyzer] Extend NoStoreFuncVisitor to follow fields.George Karpenkov2018-08-023-5/+211
| | | | | | | | rdar://39701823 Differential Revision: https://reviews.llvm.org/D49901 llvm-svn: 338667
* [analyzer] Fix eliding the same destructor twice due to buggy default arguments.Artem Dergachev2018-07-311-0/+15
| | | | | | | | | | | Because of incomplete support for CXXDefaultArgExpr, we cannot yet commit to asserting that the same destructor won't be elided twice. Suppress the assertion failure for now. Proper support is still an open problem. Differential Revision: https://reviews.llvm.org/D49213 llvm-svn: 338441
* [CFG] [analyzer] Implement function argument construction contexts.Artem Dergachev2018-07-312-16/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | In r330377 and r338425 we have already identified what constitutes function argument constructors and added stubs in order to prevent confusing them with other temporary object constructors. Now we implement a ConstructionContext sub-class to carry all the necessary information about the construction site, namely call expression and argument index. On the analyzer side, the patch interacts with the recently implemented pre-C++17 copy elision support in an interesting manner. If on the CFG side we didn't find a construction context for the elidable constructor, we build the CFG as if the elidable constructor is not elided, and the non-elided constructor within it is a simple temporary. But the same problem may occur in the analyzer: if the elidable constructor has a construction context but the analyzer doesn't implement such context yet, the analyzer should also try to skip copy elision and still inline the non-elided temporary constructor. This was implemented by adding a "roll back" mechanism: when elision fails, roll back the changes and proceed as if it's a simple temporary. The approach is wonky, but i'm fine with that as long as it's merely a defensive mechanism that should eventually go away once all construction contexts become supported. Differential Revision: https://reviews.llvm.org/D48681. llvm-svn: 338436
* [analyzer] Move InnerPointerChecker out of alpha.Reka Kovacs2018-07-311-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D49058 llvm-svn: 338433
* [CFG] [analyzer] Add construction contexts for returning C++ objects in ObjC++.Artem Dergachev2018-07-312-0/+89
| | | | | | | | | | | Like any normal funciton, Objective-C message can return a C++ object in Objective-C++. Such object would require a construction context. This patch, therefore, is an extension of r327343 onto Objective-C++. Differential Revision: https://reviews.llvm.org/D48608 llvm-svn: 338426
* [CFG] [analyzer] Add stubs for constructor and message argument constructors.Artem Dergachev2018-07-314-4/+125
| | | | | | | | | | | | | | | | | | CFG now correctly identifies construction context for temporaries constructed for the purpose of passing into a function as an argument. Such context is still not fully implemented because the information it provides is not rich enough: it doens't contain information about argument index. It will be addresssed later. This patch is an extension of r330377 to C++ construct-expressions and Objective-C message expressions which aren't call-expressions but require similar handling. C++ new-expressions with placement arguments still remain to be handled. Differential Revision: https://reviews.llvm.org/D49826 llvm-svn: 338425
* [analyzer] Don't try to simplify mixed Loc/NonLoc expressions.Artem Dergachev2018-07-311-0/+7
| | | | | | | | | | | | | | | | | | This fix is similar to r337769 and addresses a regression caused by r337167. When an operation between a nonloc::LocAsInteger and a non-pointer symbol is performed, the LocAsInteger-specific part of information is lost. When the non-pointer symbol is collapsing into a constant, we cannot easily re-evaluate the result, because we need to recover the missing LocAsInteger-specific information (eg., integer type, or the very fact that this pointer was at some point converted to an integer). Add one more defensive check to prevent crashes on trying to simplify a SymSymExpr with different Loc-ness of operands. Differential Revision: llvm-svn: 338420
* [analyzer] Rename test: cxx17-mandatory-elision.cpp -> copy-elision.cppArtem Dergachev2018-07-311-0/+0
| | | | | | It reflects its contents more accurately. No functional change intended. llvm-svn: 338339
* [analyzer] CStringChecker: Remember to highlight the argument expression range.Artem Dergachev2018-07-301-0/+15
| | | | | | | | | | | | | | | | | | | | | When emitting a bug report, it is important to highlight which argument of the call-expression is causing the problem. Before: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^~~~~~~~~~~~ After: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^      ~ Affects other output modes as well, not just text. Differential Revision: https://reviews.llvm.org/D50028 llvm-svn: 338333
* [analyzer] Bugfix for autorelease + main run loop leak checkerGeorge Karpenkov2018-07-301-0/+11
| | | | | | | | | Do not warn when the other message-send-expression is correctly wrapped in a different autorelease pool. Differential Revision: https://reviews.llvm.org/D49921 llvm-svn: 338314
* [analyzer] Fix crash in RunLoopAutoreleaseChecker on empty childrenGeorge Karpenkov2018-07-301-1/+10
| | | | | | Differential Revision: https://reviews.llvm.org/D50012 llvm-svn: 338312
* [analyzer] Add support for more invalidating functions in InnerPointerChecker.Reka Kovacs2018-07-301-10/+82
| | | | | | | | | | | | According to the standard, pointers referring to the elements of a `basic_string` may be invalidated if they are used as an argument to any standard library function taking a reference to non-const `basic_string` as an argument. This patch makes InnerPointerChecker warn for these cases. Differential Revision: https://reviews.llvm.org/D49656 llvm-svn: 338259
* [analyzer] Extend NoStoreFuncVisitor to insert a note on IVarsGeorge Karpenkov2018-07-272-4/+50
| | | | | | | | | | | | | | The note is added in the following situation: - We are throwing a nullability-related warning on an IVar - The path goes through a method which *could have* (syntactically determined) written into that IVar, but did not rdar://42444460 Differential Revision: https://reviews.llvm.org/D49689 llvm-svn: 338149
* Add missing temporary materialization conversion on left-hand side of .Richard Smith2018-07-273-240/+256
| | | | | | | | | in some member function calls. Specifically, when calling a conversion function, we would fail to create the AST node representing materialization of the class object. llvm-svn: 338135
* [analyzer] Syntactic matcher for leaks associated with run loop and ↵George Karpenkov2018-07-252-0/+108
| | | | | | | | | | | | | | | | | | | | | | | autoreleasepool A checker for detecting leaks resulting from allocating temporary autoreleasing objects before starting the main run loop. Checks for two antipatterns: 1. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in the same autorelease pool. 2. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in no autorelease pool. Happens-before relationship is modeled purely syntactically. rdar://39299145 Differential Revision: https://reviews.llvm.org/D49528 llvm-svn: 337876
* Revert "[analyzer] Extend NoStoreFuncVisitor to insert a note on IVars"George Karpenkov2018-07-242-50/+4
| | | | | | | This reverts commit a9e21bd727112cd69eabc1af648c5da6b773d06e. Reverted because the dependency has not landed yet. llvm-svn: 337866
* [analyzer] Extend NoStoreFuncVisitor to insert a note on IVarsGeorge Karpenkov2018-07-242-4/+50
| | | | | | | | | | | | | | The note is added in the following situation: - We are throwing a nullability-related warning on an IVar - The path goes through a method which *could have* (syntactically determined) written into that IVar, but did not rdar://42444460 Differential Revision: https://reviews.llvm.org/D49689 llvm-svn: 337864
OpenPOWER on IntegriCloud