summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix typos in clangAlexander Kornienko2018-04-0612-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found via codespell -q 3 -I ../clang-whitelist.txt Where whitelist consists of: archtype cas classs checkk compres definit frome iff inteval ith lod methode nd optin ot pres statics te thru Patch by luzpaz! (This is a subset of D44188 that applies cleanly with a few files that have dubious fixes reverted.) Differential revision: https://reviews.llvm.org/D44188 llvm-svn: 329399
* [analyzer][test] Set C++14 as language standard for test depending on newJan Korous2018-04-041-1/+1
| | | | | | features llvm-svn: 329225
* [analyzer] Fix diagnostics in callees of interesting callees.Artem Dergachev2018-04-031-0/+302
| | | | | | | | | | | | | | | removeUnneededCalls() is responsible for removing path diagnostic pieces within functions that don't contain "interesting" events. It makes bug reports much tidier. When a stack frame is known to be interesting, the function doesn't descend into it to prune anything within it, even other callees that are totally boring. Fix the function to prune boring callees in interesting stack frames. Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 329102
* [analyzer] Unroll the loop when it has a unsigned counter.Henry Wong2018-03-311-0/+23
| | | | | | | | | | | | | | | | | Summary: The original implementation in the `LoopUnrolling.cpp` didn't consider the case where the counter is unsigned. This case is only handled in `simpleCondition()`, but this is not enough, we also need to deal with the unsinged counter with the counter initialization. Since `IntegerLiteral` is `signed`, there is a `ImplicitCastExpr<IntegralCast>` in `unsigned counter = IntergerLiteral`. This patch add the `ignoringParenImpCasts()` in the `IntegerLiteral` matcher. Reviewers: szepet, a.sidorin, NoQ, george.karpenkov Reviewed By: szepet, george.karpenkov Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45086 llvm-svn: 328919
* [analyzer] Hopefully fix the ARM buildbot.George Karpenkov2018-03-312-10/+9
| | | | llvm-svn: 328913
* [analyzer] Fix assertion crash in CStringCheckerGeorge Karpenkov2018-03-311-0/+11
| | | | | | | | | | An offset might be unknown. rdar://39054939 Differential Revision: https://reviews.llvm.org/D45115 llvm-svn: 328912
* [analyzer] Fix liveness calculation for C++17 structured bindingsGeorge Karpenkov2018-03-311-0/+124
| | | | | | | | | | | | | C++ structured bindings for non-tuple-types are defined in a peculiar way, where the resulting declaration is not a VarDecl, but a BindingDecl. That means a lot of existing machinery stops working. rdar://36912381 Differential Revision: https://reviews.llvm.org/D44956 llvm-svn: 328910
* [analyzer] Fix test triple in missing-bind-temporary.cpp.Artem Dergachev2018-03-301-2/+2
| | | | | | | | | Otherwise the default triple for x86-windows-msvc2015 auto-inserts __attribute__((thiscall)) to some calls. Fixes the respective buildbot. llvm-svn: 328903
* [analyzer] Track null or undef values through pointer arithmetic.Artem Dergachev2018-03-302-3/+45
| | | | | | | | | | | | | | | | | | Pointer arithmetic on null or undefined pointers results in null or undefined pointers. This is obvious for undefined pointers; for null pointers it follows from our incorrect-but-somehow-working approach that declares that 0 (Loc) doesn't necessarily represent a pointer of numeric address value 0, but instead it represents any pointer that will cause a valid "null pointer dereference" issue when dereferenced. For now we've been seeing through pointer arithmetic at the original dereference expression, i.e. in bugreporter::getDerefExpr(), but not during further investigation of the value's origins in bugreporter::trackNullOrUndefValue(). The patch fixes it. Differential Revision: https://reviews.llvm.org/D45071 llvm-svn: 328896
* [CFG] [analyzer] Work around a disappearing CXXBindTemporaryExpr.Artem Dergachev2018-03-301-0/+130
| | | | | | | | | | | | | Sometimes template instantiation causes CXXBindTemporaryExpr to be missing in its usual spot. In CFG, temporary destructors work by relying on CXXBindTemporaryExprs, so they won't work in this case. Avoid the crash and notify the clients that we've encountered an unsupported AST by failing to provide the ill-formed construction context for the temporary. Differential Revision: https://reviews.llvm.org/D44955 llvm-svn: 328895
* [CFG] [analyzer] Avoid modeling C++17 constructors that aren't fully supported.Artem Dergachev2018-03-303-2/+66
| | | | | | | | | | | | | | Not enough work has been done so far to ensure correctness of construction contexts in the CFG when C++17 copy elision is in effect, so for now we should drop construction contexts in the CFG and in the analyzer when they seem different from what we support anyway. This includes initializations with conditional operators and return values across multiple stack frames. Differential Revision: https://reviews.llvm.org/D44854 llvm-svn: 328893
* Adding UNSUPPORTED: system-windows at George's request until the problem can ↵Douglas Yung2018-03-301-0/+1
| | | | | | be debugged. llvm-svn: 328853
* [analyzer] Fix target triple for autorelease-write-checker testGeorge Karpenkov2018-03-291-1/+2
| | | | llvm-svn: 328837
* [analyzer] Path-insensitive checker for writes into an auto-releasing pointerGeorge Karpenkov2018-03-291-0/+171
| | | | | | | | | | from the wrong auto-releasing pool, as such writes may crash. rdar://25301111 Differential Revision: https://reviews.llvm.org/D44722 llvm-svn: 328827
* [analyzer] LoopUnrolling: update the matched assignment operatorsPeter Szecsi2018-03-271-11/+99
| | | | | | | | | Extended the matched assignment operators when checking for bound changes in a body of the loop by using the freshly added isAssignmentOperator matcher. This covers all the (current) possible assignments, tests added as well. Differential Revision: https://reviews.llvm.org/D38921 llvm-svn: 328619
* [analyzer] Do not crash in CallEvent.getReturnType()George Karpenkov2018-03-242-0/+18
| | | | | | When the call expression is not available. llvm-svn: 328406
* [analyzer] Trust _Nonnull annotations for system frameworkGeorge Karpenkov2018-03-232-0/+52
| | | | | | | | | | | Changes the analyzer to believe that methods annotated with _Nonnull from system frameworks indeed return non null objects. Local methods with such annotation are still distrusted. rdar://24291919 Differential Revision: https://reviews.llvm.org/D44341 llvm-svn: 328282
* [analyzer] Extend GCDAntipatternChecker to match group_enter/group_leave patternGeorge Karpenkov2018-03-231-0/+54
| | | | | | | | rdar://38480416 Differential Revision: https://reviews.llvm.org/D44653 llvm-svn: 328281
* [analyzer] Enable temporary object destructor inlining by default.Artem Dergachev2018-03-221-1/+1
| | | | | | | | | | | | When a temporary is constructed with a proper construction context, it should be safe to inline the destructor. We have added suppressions for some of the common false positives caused by such inlining, so there should be - and from my observations there indeed is - more benefit than harm from enabling destructor inlining. Differential Revision: https://reviews.llvm.org/D44721 llvm-svn: 328258
* [CFG] [analyzer] Add C++17-specific ctor-initializer construction contexts.Artem Dergachev2018-03-221-0/+28
| | | | | | | | | | CXXCtorInitializer-based constructors are also affected by the C++17 mandatory copy elision, like variable constructors and return value constructors. Extend r328248 to support those. Differential Revision: https://reviews.llvm.org/D44763 llvm-svn: 328255
* [analyzer] Remove an assertion that doesn't hold in C++17.Artem Dergachev2018-03-222-0/+7
| | | | | | | | | | | | Function return values can be constructed directly in variables or passed directly into return statements, without even an elidable copy in between. This is how the C++17 mandatory copy elision AST behaves. The behavior we'll have in such cases is the "old" behavior that we've had before we've implemented destructor inlining and proper lifetime extension support. Differential Revision: https://reviews.llvm.org/D44755 llvm-svn: 328253
* [CFG] [analyzer] Add C++17-specific variable and return construction contexts.Artem Dergachev2018-03-221-113/+209
| | | | | | | | | | | | | | | | | | | In C++17 copy elision is mandatory for variable and return value constructors (as long as it doesn't involve type conversion) which results in AST that does not contain elidable constructors in their usual places. In order to provide construction contexts in this scenario we need to cover more AST patterns. This patch makes the CFG prepared for these scenarios by: - Fork VariableConstructionContext and ReturnedValueConstructionContext into two different sub-classes (each) one of which indicates the C++17 case and contains a reference to an extra CXXBindTemporaryExpr. - Allow CFGCXXRecordTypedCall element to accept VariableConstructionContext and ReturnedValueConstructionContext as its context. Differential Revision: https://reviews.llvm.org/D44597 llvm-svn: 328248
* [analyzer] Make symbol_iterator iterate over SVal's symbolic base.Artem Dergachev2018-03-221-0/+56
| | | | | | | | | | | | | | | | | | | | | | If a memory region (or an SVal that represents a pointer to that memory region) is a (direct or indirect, not necessarily proper) sub-region of a SymbolicRegion then it is said to have a symbolic base. For now SVal::symbol_iterator explores the symbol within a symbolic region only when the SVal represents a pointer to the symbolic region itself, not to any of its sub-regions. This behavior is not indended by any user of symbol_iterator; all users who cared about such behavior were expecting the iterator to descend into the symbolic base of an arbitrary region, find the parent symbol of the symbolic base region, and iterate over that symbol. Lack of such behavior resulted in bugs demonstarted by the test cases. Hence the decision to change the API to behave more intuitively. Differential Revision: https://reviews.llvm.org/D44347 llvm-svn: 328247
* [analyzer] Suppress more MallocChecker positives in smart pointer destructors.Artem Dergachev2018-03-211-1/+5
| | | | | | | | | | | | | | | | | r326249 wasn't quite enough because we often run out of inlining stack depth limit and for that reason fail to see the atomics we're looking for. Add a more straightforward false positive suppression that is based on the name of the class. I.e. if we're releasing a pointer in a destructor of a "something shared/intrusive/reference/counting something ptr/pointer something", then any use-after-free or double-free that occurs later would likely be a false positive. rdar://problem/38013606 Differential Revision: https://reviews.llvm.org/D44281 llvm-svn: 328066
* [analyzer] Fix the crash in IteratorChecker.cpp when 'SymbolConjured' has a ↵Henry Wong2018-03-201-0/+14
| | | | | | | | | | null Stmt. When the loop has a null terminator statement and sets 'widen-loops=true', 'invalidateRegions' will constructs the 'SymbolConjured' with null 'Stmt'. And this will lead to a crash in 'IteratorChecker.cpp'. This patch use 'dyn_cast_or_null<>' instead of 'dyn_cast<>' in IteratorChecker.cpp. Differential Revision: https://reviews.llvm.org/D44606 llvm-svn: 327962
* [analyzer] Fix the assertion failure when static globals are used in lambda ↵George Karpenkov2018-03-201-0/+17
| | | | | | | | | | | | by reference Also use the opportunity to clean up the code and remove unnecessary duplication. rdar://37625895 Differential Revision: https://reviews.llvm.org/D44594 llvm-svn: 327926
* [analyzer] Fix crashes in RetainCountChecker when underlying region is not a varGeorge Karpenkov2018-03-161-0/+25
| | | | | | | | | | | | For other regions, the error message contains a good indication of the problem, and there, in general, nothing helpful we can print. Error pointer to the problematic expression seems enough. rdar://37323555 Differential Revision: https://reviews.llvm.org/D44409 llvm-svn: 327727
* [analyzer] Explicitly set an -std level for the analyzer test.George Karpenkov2018-03-141-1/+1
| | | | llvm-svn: 327591
* [analyzer] Fix the matcher for GCDAntipattern to look for "signal" call in ↵George Karpenkov2018-03-131-0/+15
| | | | | | | | all parameters rdar://38405904 llvm-svn: 327426
* [CFG] [analyzer] Don't add construction context to a return-by-reference call.Artem Dergachev2018-03-122-0/+54
| | | | | | | | | | | | | | Call expressions that return objects by an lvalue reference or an rvalue reference have a value type in the AST but wear an auxiliary flag of being an lvalue or an xvalue respectively. Use the helper method for obtaining the actual return type of the function. Fixes a crash. Differential Revision: https://reviews.llvm.org/D44273 llvm-svn: 327352
* [analyzer] Support temporaries conjured by conservatively evaluated functions.Artem Dergachev2018-03-122-3/+51
| | | | | | | | | | | | | | Properly perform destruction and lifetime extension of such temporaries. C++ object-type return values of conservatively evaluated functions are now represented as compound values of well-defined temporary object regions. The function creates a region that represents the temporary object and will later be used for destruction or materialization, invalidates it, and returns the invalidated compound value of the object. Differential Revision: https://reviews.llvm.org/D44131 llvm-svn: 327348
* [analyzer] Destroy and lifetime-extend inlined function return values properly.Artem Dergachev2018-03-121-0/+156
| | | | | | | | | | | | | | | This patch uses the newly added CFGCXXRecordTypedCall element at the call site of the caller to construct the return value within the callee directly into the caller's stack frame. This way it is also capable of populating the temporary destructor and lifetime extension maps for the temporary, which allows temporary destructors and lifetime extension to work correctly. This patch does not affect temporaries that were returned from conservatively evaluated functions. Differential Revision: https://reviews.llvm.org/D44124 llvm-svn: 327345
* [CFG] [analyzer] Add construction context to C++ return-by-value call elements.Artem Dergachev2018-03-122-13/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new CFGStmt sub-class, CFGCXXRecordTypedCall, which replaces the regular CFGStmt for the respective CallExpr whenever the CFG has additional information to provide regarding the lifetime of the returned value. This additional call site information is represented by a ConstructionContext (which was previously used for CFGConstructor elements) that provides references to CXXBindTemporaryExpr and MaterializeTemporaryExpr that surround the call. This corresponds to the common C++ calling convention solution of providing the target address for constructing the return value as an auxiliary implicit argument during function call. One of the use cases for such extra context at the call site would be to perform any sort of inter-procedural analysis over the CFG that involves functions returning objects by value. In this case the elidable constructor at the return site would construct the object explained by the context at the call site, and its lifetime would also be managed by the caller, not the callee. The extra context would also be useful for properly handling the return-value temporary at the call site, even if the callee is not being analyzed inter-procedurally. Differential Revision: https://reviews.llvm.org/D44120 llvm-svn: 327343
* [analyzer] Move the GCDAsyncSemaphoreChecker to optin.performanceGeorge Karpenkov2018-03-121-19/+51
| | | | | | | | rdar://38383753 Differential Revision: https://reviews.llvm.org/D44228 llvm-svn: 327309
* [analyzer] Trying to fix Windows buildbots after r327258Maxim Ostapenko2018-03-121-1/+1
| | | | llvm-svn: 327270
* [analyzer] Trying to fix buildbots after r327258Maxim Ostapenko2018-03-121-2/+2
| | | | llvm-svn: 327263
* [analyzer] Add scope information to CFGMaxim Ostapenko2018-03-123-2/+1175
| | | | | | | | | | | This patch adds two new CFG elements CFGScopeBegin and CFGScopeEnd that indicate when a local scope begins and ends respectively. We use first VarDecl declared in a scope to uniquely identify it and add CFGScopeBegin and CFGScopeEnd elements into corresponding basic blocks. Differential Revision: https://reviews.llvm.org/D16403 llvm-svn: 327258
* [analyzer] MmapWriteExecChecker: Add support for mprotect().Artem Dergachev2018-03-091-0/+8
| | | | | | | | | | | mprotect() allows setting memory access flags similarly to mmap(), causing similar security issues if these flags are needlessly broad. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D44250 llvm-svn: 327098
* [CFG] [analyzer] Add construction context for implicit constructor conversions.Artem Dergachev2018-03-092-3/+98
| | | | | | | | | | | | | Implicit constructor conversions such as A a = B() are represented by surrounding the constructor for B() with an ImplicitCastExpr of CK_ConstructorConversion kind, similarly to how explicit constructor conversions are surrounded by a CXXFunctionalCastExpr. Support this syntax pattern when extracting the construction context for the implicit constructor that performs the conversion. Differential Revision: https://reviews.llvm.org/D44051 llvm-svn: 327096
* [analyzer] Correctly model iteration through "nil" objectsGeorge Karpenkov2018-03-081-0/+8
| | | | | | | | | | | | | | | | | | | | Previously, iteration through nil objects which resulted from objc-messages being set to nil were modeled incorrectly. There are a couple of notes about this patch: In principle, ExprEngineObjC might be left untouched IFF osx.loops checker is enabled. I however think that we should not do something completely incorrect depending on what checkers are left on. We should evaluate and potentially remove altogether the isConsumedExpr performance heuristic, as it seems very fragile. rdar://22205149 Differential Revision: https://reviews.llvm.org/D44178 llvm-svn: 326982
* [analyzer] [PointerArithChecker] do not warn on indexes into vector typesGeorge Karpenkov2018-03-071-0/+6
| | | | | | | | rdar://35041502 Differential Revision: https://reviews.llvm.org/D44172 llvm-svn: 326952
* [analyzer] Don't crash with assertion failure on structured bindingsGeorge Karpenkov2018-03-071-0/+10
| | | | | | | | | | | | Proper modeling still remains to be done. Note that BindingDecl#getHoldingVar() is almost always null, and this should probably be handled by dealing with DecompositionDecl beforehand. rdar://36852163 Differential Revision: https://reviews.llvm.org/D44183 llvm-svn: 326951
* [analyzer] Fix the checker for the performance anti-pattern to accept messagesGeorge Karpenkov2018-03-071-0/+31
| | | | | | | | send to ObjC objects. Differential Revision: https://reviews.llvm.org/D44170 llvm-svn: 326868
* [Analyzer] More accurate modeling about the increment operator of the ↵Henry Wong2018-03-062-0/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | operand with type bool. Summary: There is a problem with analyzer that a wrong value is given when modeling the increment operator of the operand with type bool. After `rL307604` is applied, a unsigned overflow may occur. Example: ``` void func() { bool b = true; // unsigned overflow occur, 2 -> 0 U1b b++; } ``` The use of an operand of type bool with the ++ operators is deprecated but valid untill C++17. And if the operand of the increment operator is of type bool, it is set to true. This patch includes two parts: - If the operand of the increment operator is of type bool or type _Bool, set to true. - Modify `BasicValueFactory::getTruthValue()`, use `getIntWidth()` instead `getTypeSize()` and use `unsigned` instead `signed`. Reviewers: alexshap, NoQ, dcoughlin, george.karpenkov Reviewed By: NoQ Subscribers: xazax.hun, szepet, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D43741 llvm-svn: 326776
* Move test/gcdasyncsemaphorechecker_test.m to a subdirectoryAlexander Kornienko2018-03-061-0/+203
| | | | llvm-svn: 326772
* [analyzer] Improves the logic of GenericTaintChecker identifying stdin.Henry Wong2018-03-051-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: GenericTaintChecker can't recognize stdin in some cases. The reason is that `if (PtrTy->getPointeeType() == C.getASTContext().getFILEType()` does not hold when stdin is encountered. My platform is ubuntu16.04 64bit, gcc 5.4.0, glibc 2.23. The definition of stdin is as follows: ``` __BEGIN_NAMESPACE_STD /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE FILE; ___END_NAMESPACE_STD ... /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE __FILE; ... /* Standard streams. */ extern struct _IO_FILE *stdin; /* Standard input stream. */ extern struct _IO_FILE *stdout; /* Standard output stream. */ extern struct _IO_FILE *stderr; /* Standard error output stream. */ ``` The type of stdin is as follows AST: ``` ElaboratedType 0xc911170'struct _IO_FILE'sugar `-RecordType 0xc911150'struct _IO_FILE' `-CXXRecord 0xc923ff0'_IO_FILE' ``` `C.getASTContext().GetFILEType()` is as follows AST: ``` TypedefType 0xc932710 'FILE' sugar |-Typedef 0xc9111c0 'FILE' `-ElaboratedType 0xc911170 'struct _IO_FILE' sugar `-RecordType 0xc911150 'struct _IO_FILE' `-CXXRecord 0xc923ff0 '_IO_FILE' ``` So I think it's better to use `getCanonicalType()`. Reviewers: zaks.anna, NoQ, george.karpenkov, a.sidorin Reviewed By: zaks.anna, a.sidorin Subscribers: a.sidorin, cfe-commits, xazax.hun, szepet, MTC Differential Revision: https://reviews.llvm.org/D39159 llvm-svn: 326709
* [analyzer] Don't throw NSNumberObjectConversion warning on object ↵George Karpenkov2018-03-021-0/+13
| | | | | | | | | | | | | | | initialization in if-expression ``` if (NSNumber* x = ...) ``` is a reasonable pattern in objc++, we should not warn on it. rdar://35152234 Differential Revision: https://reviews.llvm.org/D44044 llvm-svn: 326619
* [analyzer] [tests] Again, make tests more resilient to changes in ↵George Karpenkov2018-03-022-2/+2
| | | | | | exploration strategy llvm-svn: 326529
* [analyzer] Prevent crashing in NonNullParamCheckerGeorge Karpenkov2018-03-021-0/+11
| | | | | | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=36381 rdar://37543426 Turns out, the type passed for the lambda capture was incorrect. One more argument to abandon the getSVal overload which does not require the type information. Differential Revision: https://reviews.llvm.org/D43925 llvm-svn: 326520
* [analyzer] [NFC] [tests] Make test more resilient to changes in exploration ↵George Karpenkov2018-03-021-2/+7
| | | | | | strategy llvm-svn: 326518
OpenPOWER on IntegriCloud