summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Fix offset overflow check in MemRegionGeorge Karpenkov2018-06-131-1/+6
| | | | | | | | | rdar://39593879 https://bugs.llvm.org/show_bug.cgi?id=37142 Differential Revision: https://reviews.llvm.org/D48139 llvm-svn: 334636
* [analyzer] Do not crash in the visitor when the function is given more ↵George Karpenkov2018-06-121-0/+15
| | | | | | | | | | arguments than it has parameters rdar://40335545 Differential Revision: https://reviews.llvm.org/D48107 llvm-svn: 334560
* [analyzer] Ensure that loop widening does not invalidate referencesMatthew Voss2018-06-121-0/+14
| | | | | | | | | | Loop widening can invalidate a reference. If the analyzer attempts to visit the destructor to a non-existent reference, it will crash. This patch ensures that the reference is preserved. https://reviews.llvm.org/D47044 llvm-svn: 334554
* [analyzer] [NFC] Remove unused Extensive diagnostic setting,George Karpenkov2018-06-1230-3443/+3009
| | | | | | | | | | | | | | Rename AlternateExtensive to Extensive. In 2013, five years ago, we have switched to AlternateExtensive diagnostics by default, and Extensive was available under unused, undocumented flag. This change remove the flag, renames the Alternate diagnostic to Extensive (as it's no longer Alternate), and ports the test. Differential Revision: https://reviews.llvm.org/D47670 llvm-svn: 334524
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-091-0/+71
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [Analyzer][Z3] Test fixes for Z3 constraint managerVlad Tsyrklevich2018-06-064-0/+12
| | | | | | | | | | | | | | | | | | Summary: Since Z3 tests have been not been running [1] some tests needed to be updated. I also added a regression test for [1]. [1] https://reviews.llvm.org/D47722 Reviewers: george.karpenkov, NoQ, ddcc Reviewed By: george.karpenkov Subscribers: mikhail.ramalho, dcoughlin, xazax.hun, szepet, zzheng, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D47726 llvm-svn: 334067
* [Analyzer] Fix Z3ConstraintManager crash (PR37646)Vlad Tsyrklevich2018-06-062-7/+16
| | | | | | | | | | | | | | | | Summary: Fix another Z3ConstraintManager crash, use fixAPSInt() to extend a boolean APSInt. Reviewers: george.karpenkov, NoQ, ddcc Reviewed By: george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D47617 llvm-svn: 334065
* [analyzer] Re-enable constructors when lifetime extension through fields occurs.Artem Dergachev2018-06-041-6/+18
| | | | | | | | | | | | | | | | Temporary object constructor inlining was disabled in r326240 for code like const int &x = A().x; because automatic destructor for the lifetime-extended object A() was not working correctly in CFG. CFG was fixed in r333941, so inlining can be re-enabled. CFG for lifetime extension through aggregates still needs to be fixed. Differential Revision: https://reviews.llvm.org/D44239 llvm-svn: 333946
* [CFG] Fix automatic destructors when a member is bound to a reference.Artem Dergachev2018-06-041-4/+291
| | | | | | | | | | | | | | | | | | | In code like const int &x = A().x; automatic destructor for the object A() lifetime-extended by reference 'x' was not present in the clang CFG due to ad-hoc pattern-matching in getReferenceInitTemporaryType(). Re-use skipRValueSubobjectAdjustments() again to find the lifetime-extended object in the AST and emit the correct destructor. Lifetime extension through aggregates with references still needs to be covered. Differential Revision: https://reviews.llvm.org/D44238 llvm-svn: 333941
* [analyzer] False positive refutation with Z3Mikhail R. Gadelha2018-06-041-0/+51
| | | | | | | | | | | | | | Summary: This is a prototype of a bug reporter visitor that invalidates bug reports by re-checking constraints of certain states on the bug path using the Z3 constraint manager backend. The functionality is available under the `crosscheck-with-z3` analyzer config flag. Reviewers: george.karpenkov, NoQ, dcoughlin, rnkovacs Reviewed By: george.karpenkov Subscribers: rnkovacs, NoQ, george.karpenkov, dcoughlin, xbolva00, ddcc, mikhail.ramalho, MTC, fhahn, whisperity, baloghadamsoftware, szepet, a.sidorin, gsd, dkrupp, xazax.hun, cfe-commits Differential Revision: https://reviews.llvm.org/D45517 llvm-svn: 333903
* [analyzer] fix bug with 1-bit APSInt types in Z3ConstraintManagerDominic Chen2018-05-311-0/+7
| | | | | | | | | | | | Summary: Clang does not have a corresponding QualType for a 1-bit APSInt, so use the BoolTy and extend the APSInt. Split from D35450. Fixes PR37622. Reviewers: george.karpenkov, NoQ Subscribers: mikhail.ramalho, xazax.hun, szepet, rnkovacs, cfe-commits, a.sidorin Differential Revision: https://reviews.llvm.org/D47603 llvm-svn: 333704
* [analyzer] Improve performance of the SVal simplification mechanism.Artem Dergachev2018-05-311-0/+30
| | | | | | | | | | | | When neither LHS nor RHS of a binary operator expression can be simplified, return the original expression instead of re-evaluating the binary operator. Such re-evaluation was causing recusrive re-simplification which caused the algorithmic complexity to explode. Differential Revision: https://reviews.llvm.org/D47155 llvm-svn: 333670
* [analyzer] Trust _Nonnull annotations, and trust analyzer knowledge about ↵George Karpenkov2018-05-312-5/+32
| | | | | | | | | | | | | | | receiver nullability Previously, the checker was using the nullability of the expression, which is nonnull IFF both receiver and method are annotated as _Nonnull. However, the receiver could be known to the analyzer to be nonnull without being explicitly marked as _Nonnull. rdar://40635584 Differential Revision: https://reviews.llvm.org/D47510 llvm-svn: 333612
* [analyzer] const init: handle non-explicit cases more accuratelyRafael Stahl2018-05-292-2/+43
| | | | | | | | | | | | | | Summary: If the access is out of bounds, return UndefinedVal. If it is missing an explicit init, return the implicit zero value it must have. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D46823 llvm-svn: 333417
* [analyzer] Add security checks for bcmp(), bcopy(), bzero().Artem Dergachev2018-05-261-0/+21
| | | | | | | | | | | These functions are obsolete. The analyzer would advice to replace them with memcmp(), memcpy() or memmove(), or memset(). Patch by Tom Rix! Differential Revision: https://reviews.llvm.org/D41881 llvm-svn: 333326
* [analyzer] Added template argument lists to the Pathdiagnostic outputKristof Umann2018-05-252-0/+83
| | | | | | | | | | | Because template parameter lists were not displayed in the plist output, it was difficult to decide in some cases whether a given checker found a true or a false positive. This patch aims to correct this. Differential Revision: https://reviews.llvm.org/D46933 llvm-svn: 333275
* [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the ↵David Carlier2018-05-231-0/+5
| | | | | | | | | | | | | | dest buffer Again, strlc* does not return a pointer so the zero size case doest not fit. Reviewers: NoQ, george.karpenkov Reviewed by: NoQ Differential Revision: https://reviews.llvm.org/D47007 llvm-svn: 333060
* [analyzer] Extend ObjCAutoreleaseWriteChecker to catch block declarations ↵George Karpenkov2018-05-161-0/+12
| | | | | | | | with autoreleasing variables Differential Revision: https://reviews.llvm.org/D46984 llvm-svn: 332546
* [analyzer] Change the warning message for GCD antipattern checkerGeorge Karpenkov2018-05-161-21/+21
| | | | llvm-svn: 332544
* [analyzer] Improve the modeling of memset().Henry Wong2018-05-163-9/+410
| | | | | | | | | | | | Since there is no perfect way bind the non-zero value with the default binding, this patch only considers the case where buffer's offset is zero and the char value is 0. And according to the value for overwriting, decide how to update the string length. Reviewers: dcoughlin, NoQ, xazax.hun, a.sidorin, george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D44934 llvm-svn: 332463
* [analyzer] Do not crash on callback for call_once passed by valueGeorge Karpenkov2018-05-161-0/+9
| | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=37312 rdar://40270582 Differential Revision: https://reviews.llvm.org/D46913 llvm-svn: 332422
* [analyzer] Make plist-html diagnostic consumer produce multi-file reports.Artem Dergachev2018-05-162-0/+208
| | | | | | | | | | | Previously plist-html output produced multi-file HTML reports but only single-file Plist reports. Change plist-html output to produce multi-file Plist reports as well. Differential Revision: https://reviews.llvm.org/D46902 llvm-svn: 332417
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-0/+40
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Extend the ObjCAutoreleaseWriteChecker to warn on captures as wellGeorge Karpenkov2018-05-141-0/+55
| | | | | | | | | | A common pattern is that the code in the block does not write into the variable explicitly, but instead passes it to a helper function which performs the write. Differential Revision: https://reviews.llvm.org/D46772 llvm-svn: 332300
* [analyzer] Ignore the nullability quantifiers for autoreleasewritecheckerGeorge Karpenkov2018-05-111-0/+7
| | | | llvm-svn: 332136
* [analyzer] Fix the filename for the exploration_order test.George Karpenkov2018-05-111-6/+9
| | | | | | Ensures that the test is being run. llvm-svn: 332135
* Fixes issue introduced by r331556.Alexander Kornienko2018-05-091-0/+7
| | | | | | | | | | Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357 Patch by Rafael Stahl! Differential revision: https://reviews.llvm.org/D46633 llvm-svn: 331870
* [analyzer] Invalidate union regions properly. Don't hesitate to load later.Artem Dergachev2018-05-041-2/+18
| | | | | | | | | | | | | | | | | | | We weren't invalidating our unions correctly. The previous behavior in invalidateRegionsWorker::VisitCluster() was to direct-bind an UnknownVal to the union (at offset 0). For that reason we were never actually loading default bindings from our unions, because there never was any default binding to load, and the value that is presumed when there's no default binding to load is usually completely incorrect (eg. UndefinedVal for stack unions). The new behavior is to default-bind a conjured symbol (of irrelevant type) to the union that's being invalidated, similarly to what we do for structures and classes. Then it becomes safe to load the value properly. Differential Revision: https://reviews.llvm.org/D45241 llvm-svn: 331563
* [analyzer] pr36458: Fix retrieved value cast for symbolic void pointers.Artem Dergachev2018-05-041-0/+22
| | | | | | | | | | | | | C allows us to write any bytes into any memory region. When loading weird bytes from memory regions of known types, the analyzer is required to make sure that the loaded value makes sense by casting it to an appropriate type. Fix such cast for loading values that represent void pointers from non-void pointer type places. Differential Revision: https://reviews.llvm.org/D46415 llvm-svn: 331562
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-041-4/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] pr37209: Fix casts of glvalues to references.Artem Dergachev2018-05-041-0/+14
| | | | | | | | | | | | | | | Many glvalue expressions aren't of their respective reference type - they are simply glvalues of their value type. This was causing problems when we were trying to obtain type of the original expression while evaluating certain glvalue bit-casts. Fixed by artificially forging a reference type to provide to the casting procedure. Differential Revision: https://reviews.llvm.org/D46224 llvm-svn: 331558
* [analyzer] Treat more const variables and fields as known contants.Artem Dergachev2018-05-041-0/+111
| | | | | | | | | | | | | | | | When loading from a variable or a field that is declared as constant, the analyzer will try to inspect its initializer and constant-fold it. Upon success, the analyzer would skip normal load and return the respective constant. The new behavior also applies to fields/elements of brace-initialized structures and arrays. Patch by Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45774 llvm-svn: 331556
* Remove explicit cfg-temporary-dtors=trueAlexander Kornienko2018-05-047-13/+12
| | | | | | | | | | | | | | | | Summary: Remove explicit -analyzer-config cfg-temporary-dtors=true in analyzer tests, since this option defaults to true since r326461. Reviewers: NoQ Reviewed By: NoQ Subscribers: cfe-commits Differential Revision: https://reviews.llvm.org/D46393 llvm-svn: 331520
* [analyzer] Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero and VLASize.Henry Wong2018-05-021-1/+24
| | | | | | | | | | | | | | Summary: Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero, VLASize to be able to indicate where the taint information originated from. Reviewers: NoQ, george.karpenkov, xazax.hun, a.sidorin Reviewed By: NoQ Subscribers: szepet, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D46007 llvm-svn: 331345
* [analyzer] ObjCAutoreleaseWrite: Support a few more APIs and fix warning text.Artem Dergachev2018-04-271-10/+44
| | | | | | API list and improved warning text composed by Devin Coughlin. llvm-svn: 331089
* [analyzer] Fix operator delete[] array-type-sub-expression handling.Artem Dergachev2018-04-271-0/+18
| | | | | | | | | | | | Avoid crash when the sub-expression of operator delete[] is of array type. This is not the same as simply using a delete[] syntax. We're still not properly calling destructors in this case in the analyzer. Differential Revision: https://reviews.llvm.org/D46146 llvm-svn: 331014
* [analyzer] Fix a crash on lifetime extension through aggregate initialization.Artem Dergachev2018-04-251-0/+31
| | | | | | | | | | | | If 'A' is a C++ aggregate with a reference field of type 'C', in code like A a = { C() }; C() is lifetime-extended by 'a'. The analyzer wasn't expecting this pattern and crashing. Additionally, destructors aren't added in the CFG for this case, so for now we shouldn't be inlining the constructor for C(). Differential Revision: https://reviews.llvm.org/D46037 llvm-svn: 330882
* [analyzer] Enable analysis of WebKit "unified sources".Artem Dergachev2018-04-254-0/+55
| | | | | | | | | | | | | | | | | | | Normally the analyzer begins path-sensitive analysis from functions within the main file, even though the path is allowed to go through any functions within the translation unit. When a recent version of WebKit is compiled, the "unified sources" technique is used, that assumes #including multiple code files into a single main file. Such file would have no functions defined in it, so the analyzer wouldn't be able to find any entry points for path-sensitive analysis. This patch pattern-matches unified file names that are similar to those used by WebKit and allows the analyzer to find entry points in the included code files. A more aggressive/generic approach is being planned as well. Differential Revision: https://reviews.llvm.org/D45839 llvm-svn: 330876
* [analyzer] Add support for the note diagnostic pieces to plist output format.Artem Dergachev2018-04-241-3/+30
| | | | | | | | | | | | | | | | | Note diagnostic pieces are an additional way of highlighting code sections to the user. They aren't part of the normal path diagnostic sequence. They can also be attached to path-insensitive reports. Notes are already supported by the text output and scan-build. Expanding our machine-readable plist output format to be able to represent notes opens up the possibility for various analyzer GUIs to pick them up. Patch by Umann Kristóf! Differential Revision: https://reviews.llvm.org/D45407 llvm-svn: 330766
* [ASTImporter] Allow testing of import sequences; fix import of typedefs for ↵Aleksei Sidorin2018-04-243-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | anonymous decls This patch introduces the ability to test an arbitrary sequence of imports between a given set of virtual source files. This should finally allow us to write simple tests and fix annoying issues inside ASTImporter that cause failures in CSA CTU. This is done by refactoring ASTImporterTest functions and introducing `testImportSequence` facility. As a side effect, `testImport` facility was generalized a bit more. It should now allow import of non-decl AST nodes; however, there is still no test using this ability. As a "test for test", there is also a fix for import anonymous TagDecls referred by typedef. Before this patch, the setting of typedef for anonymous structure was delayed; however, this approach misses the corner case if an enum constant is imported directly. In this patch, typedefs for anonymous declarations are imported right after the anonymous declaration is imported, without any delay. Thanks to Adam Balogh for suggestions included into this patch. Differential Revision: https://reviews.llvm.org/D44079 llvm-svn: 330704
* Quick fix for rC330605: specify a target arch for testAleksei Sidorin2018-04-231-1/+1
| | | | llvm-svn: 330613
* [analyzer] Don't crash on printing ConcreteInt of size >64 bitsAleksei Sidorin2018-04-231-0/+7
| | | | | | | | Printing of ConcreteInts with size >64 bits resulted in assertion failure in get[Z|S]ExtValue() because these methods are only allowed to be used with integers of 64 max bit width. This patch fixes the issue. llvm-svn: 330605
* [CFG] [analyzer] Add construction contexts for loop condition variables.Artem Dergachev2018-04-193-8/+91
| | | | | | | | | | | | | | | | | Loop condition variables, eg. while (shared_ptr<int> P = getIntPtr()) { ... }) weren't handled in r324794 because they don't go through the common CFGBuilder::VisitDeclStmt method. Which means that they regressed after r324800. Fix the regression by duplicating the necessary construction context scan in the loop visiting code. Differential Revision: https://reviews.llvm.org/D45706 llvm-svn: 330382
* [analyzer] When we fail to evaluate a pointer cast, escape the pointer.Artem Dergachev2018-04-192-2/+13
| | | | | | | | | | | | | | If a pointer cast fails (evaluates to an UnknownVal, i.e. not implemented in the analyzer) and such cast is in fact the last use of the pointer, the pointer symbol is no longer referenced by the program state and a leak is (mis-)diagnosed. "Escape" the pointer upon a failed cast, i.e. inform the checker that we can no longer reliably track it. Differential Revision: https://reviews.llvm.org/D45698 llvm-svn: 330380
* [CFG] [analyzer] Don't treat argument constructors as temporary constructors.Artem Dergachev2018-04-191-0/+72
| | | | | | | | | | | | | | Function argument constructors (that are used for passing objects into functions by value) are completely unlike temporary object constructors, but we were treating them as such because they are also wrapped into a CXXBindTemporaryExpr. This patch adds a partial construction context layer for call argument values, but doesn't proceed to transform it into an actual construction context yet. This is tells the clients that we aren't supporting these constructors yet. Differential Revision: https://reviews.llvm.org/D45650 llvm-svn: 330377
* [analyzer] RetainCount: Accept more "safe" CFRetain wrappers.Artem Dergachev2018-04-191-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | r315736 added support for the misplaced CF_RETURNS_RETAINED annotation on CFRetain() wrappers. It works by trusting the function's name (seeing if it confirms to the CoreFoundation naming convention) rather than the annotation. There are more false positives caused by users using a different naming convention, namely starting the function name with "retain" or "release" rather than suffixing it with "retain" or "release" respectively. Because this isn't according to the naming convention, these functions are usually inlined and the annotation is therefore ignored, which is correct. But sometimes we run out of inlining stack depth and the function is evaluated conservatively and then the annotation is trusted. Add support for the "alternative" naming convention and test the situation when we're running out of inlining stack depth. rdar://problem/18270122 Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 330375
* [analyzer] Do not invalidate the `this` pointer.Henry Wong2018-04-151-0/+88
| | | | | | | | | | | | | | | | | Summary: `this` pointer is not an l-value, although we have modeled `CXXThisRegion` for `this` pointer, we can only bind it once, which is when we start to inline method. And this patch fixes https://bugs.llvm.org/show_bug.cgi?id=35506. In addition, I didn't find any other cases other than loop-widen that could invalidate `this` pointer. Reviewers: NoQ, george.karpenkov, a.sidorin, seaneveson, szepet Reviewed By: NoQ Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45491 llvm-svn: 330095
* [Analyzer] Fix for SValBuilder expressions rearrangementAdam Balogh2018-04-131-0/+5
| | | | | | | | Expression rearrangement in SValBuilder (see rL329780) crashes with an assert if the type of the integer is different from the type of the symbol. This fix adds a check that prevents rearrangement in such cases. Differential Revision: https://reviews.llvm.org/D45557 llvm-svn: 330064
* [analyzer] Fix null deref in AnyFunctionCall::getRuntimeDefinitionGabor Horvath2018-04-131-0/+14
| | | | | | | | Patch by: Rafael Stahl! Differential Revision: https://reviews.llvm.org/D45564 llvm-svn: 330009
* [Analyzer] SValBuilder Comparison Rearrangement (with Restrictions and ↵Adam Balogh2018-04-113-12/+1007
| | | | | | | | | | | | | | | | Analyzer Option) Since the range-based constraint manager (default) is weak in handling comparisons where symbols are on both sides it is wise to rearrange them to have symbols only on the left side. Thus e.g. A + n >= B + m becomes A - B >= m - n which enables the constraint manager to store a range m - n .. MAX_VALUE for the symbolic expression A - B. This can be used later to check whether e.g. A + k == B + l can be true, which is also rearranged to A - B == l - k so the constraint manager can check whether l - k is in the range (thus greater than or equal to m - n). The restriction in this version is the the rearrangement happens only if both the symbols and the concrete integers are within the range [min/4 .. max/4] where min and max are the minimal and maximal values of their type. The rearrangement is not enabled by default. It has to be enabled by using -analyzer-config aggressive-relational-comparison-simplification=true. Co-author of this patch is Artem Dergachev (NoQ). Differential Revision: https://reviews.llvm.org/D41938 llvm-svn: 329780
OpenPOWER on IntegriCloud