summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] do not crash when trying to convert an APSInt to an unexpected typeGeorge Karpenkov2017-11-091-0/+7
| | | | | | | | | | | | | | | | | | | | This is the issue breaking the postgresql bot, purely by chance exposed through taint checker, somehow appearing after https://reviews.llvm.org/D38358 got committed. The backstory is that the taint checker requests SVal for the value of the pointer, and analyzer has a "fast path" in the getter to return a constant when we know that the value is constant. Unfortunately, the getter requires a cast to get signedness correctly, and for the pointer `void *` the cast crashes. This is more of a band-aid patch, as I am not sure what could be done here "correctly", but it should be applied in any case to avoid the crash. Differential Revision: https://reviews.llvm.org/D39862 llvm-svn: 317839
* [analyzer] assume bitwise arithmetic axiomsGeorge Karpenkov2017-11-091-0/+39
| | | | | | | | | | | | | | | Patches the solver to assume that bitwise OR of an unsigned value with a constant always produces a value larger-or-equal than the constant, and bitwise AND with a constant always produces a value less-or-equal than the constant. This patch is especially useful in the context of using bitwise arithmetic for error code encoding: the analyzer would be able to state that the error code produced using a bitwise OR is non-zero. Differential Revision: https://reviews.llvm.org/D39707 llvm-svn: 317820
* [analyzer] Fix a crash on logical operators with vectors.Artem Dergachev2017-11-081-0/+28
| | | | | | | | | | | | | | | | | Do not crash when trying to compute x && y or x || y where x and y are of a vector type. For now we do not seem to properly model operations with vectors. In particular, operations && and || on a pair of vectors are not short-circuit, unlike regular logical operators, so even our CFG is incorrect. Avoid the crash, add respective FIXME tests for later. Differential Revision: https://reviews.llvm.org/D39682 rdar://problem/34317663 llvm-svn: 317700
* [analyzer] pr34779: CStringChecker: Accept non-standard headers.Artem Dergachev2017-11-071-0/+10
| | | | | | | | | | | Do not crash when trying to define and call a non-standard strcpy(unsigned char *, unsigned char *) during analysis. At the same time, do not try to actually evaluate the call. Differential Revision: https://reviews.llvm.org/D39422 llvm-svn: 317565
* [analyzer] Model correct dispatch_once() 'done' value in BodyFarmDevin Coughlin2017-11-061-240/+754
| | | | | | | | | | | | | | | | | | | | | | | The analyzer's BodyFarm models dispatch_once() by comparing the passed-in predicate against a known 'done' value. If the predicate does not have that value, the model updates the predicate to have that value and executes the passed in block. Unfortunately, the current model uses the wrong 'done' value: 1 instead of ~0. This interferes with libdispatch's static inline function _dispatch_once(), which enables a fast path if the block has already been executed. That function uses __builtin_assume() to tell the compiler that the done flag is set to ~0 on exit. When r302880 added modeling of __builtin_assume(), this caused the analyzer to assume 1 == ~0. This in turn caused the analyzer to never explore any code after a call to dispatch_once(). This patch regains the missing coverage by updating BodyFarm to use the correct 'done' value. rdar://problem/34413048 Differential Revision: https://reviews.llvm.org/D39691 llvm-svn: 317516
* [analyzer] do not crash on libcxx03 call_once implementationGeorge Karpenkov2017-11-031-0/+56
| | | | | | | | Addresses https://bugs.llvm.org/show_bug.cgi?id=35075, rdar://35230961 Differential Revision: https://reviews.llvm.org/D39518 llvm-svn: 317293
* [analyzer] Left shifting a negative value is undefinedGabor Horvath2017-10-301-0/+7
| | | | | | | | | | The analyzer did not return an UndefVal in case a negative value was left shifted. I also altered the UndefResultChecker to emit a clear warning in this case. Differential Revision: https://reviews.llvm.org/D39423 llvm-svn: 316924
* [analyzer] Use the signature of the primary template for issue hash calculationGabor Horvath2017-10-302-6/+10
| | | | | | | | | | | | | Now when a template is instantiated more times and there is a bug found in the instantiations the issue hash will be different for each instantiation even if every other property of the bug (path, message, location) is the same. This patch aims to resolve this issue. Note that explicit specializations still generate different hashes but that is intended. Differential Revision: https://reviews.llvm.org/D38728 llvm-svn: 316900
* [analyzer] Make issue hash related tests more conciseGabor Horvath2017-10-302-2492/+109
| | | | | | | | | | Extend ExprInspection checker to make it possible to dump the issue hash of arbitrary expressions. This change makes it possible to make issue hash related tests more concise and also makes debugging issue hash related problems easier. Differential Revision: https://reviews.llvm.org/D38844 llvm-svn: 316899
* [analyzer] lock_guard and unique_lock extension for BlockInCriticalSection ↵Gabor Horvath2017-10-301-0/+42
| | | | | | | | | | checker A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D33729 llvm-svn: 316892
* Add missing expected-no-diagnostics comment to test.Gabor Horvath2017-10-301-0/+1
| | | | llvm-svn: 316886
* [analyzer] Handle ObjC messages conservatively in CallDescriptionGabor Horvath2017-10-301-0/+9
| | | | | | Differential Revision: https://reviews.llvm.org/D37470 llvm-svn: 316885
* [analyzer] MisusedMovedObjectChecker: More precise warning messagePeter Szecsi2017-10-281-11/+43
| | | | | | | | | | | | Added new enum in order to differentiate the warning messages on "misusing" into 3 categories: function calls, moving an object, copying an object. (At the moment the checker gives the same message in case of copying and moving.) Additional test cases added as well. Differential Revision: https://reviews.llvm.org/D38674 llvm-svn: 316852
* [analyzer] MisusedMovedObjectChecker: Fix false positive on state-resetting, ↵Peter Szecsi2017-10-281-3/+19
| | | | | | | | | | | | | | | | | | | | handling method calls on base-class sub-objects An earlier solution from Artem r315301 solves the reset problem, however, the reports should be handled the same way in case of method calls. We should not just report the base class of the object where the method was defined but the whole object. Fixed false positive which came from not removing the subobjects in case of a state-resetting function. (Just replaced the State->remove(...) call to removeFromState(..) which was defined exactly for that purpose.) Some minor typos fixed in this patch as well which did not worth a whole new patch in my opinion, so included them here. Differential Revision: https://reviews.llvm.org/D31538 llvm-svn: 316850
* PR35039: Materialize temporary objects before wrapping them in anRichard Smith2017-10-281-27/+54
| | | | | | | | | OpaqueValueExpr in a GNU binary conditional expression. It's not meaningful for a non-materialized temporary object to be used as a common subexpression of multiple expressions. llvm-svn: 316836
* [analyzer] LoopUnrolling: check the bitwidth of the used numbers (pr34943)Peter Szecsi2017-10-281-0/+6
| | | | | | | | | | | | | | | The loop unrolling feature aims to track the maximum possible steps a loop can make. In order to implement this, it investigates the initial value of the counter variable and the bound number. (It has to be known.) These numbers are used as llvm::APInts, however, it was not checked if their bitwidths are the same which lead to some crashes. This revision solves this problem by extending the "shorter" one (to the length of the "longer" one). For the detailed bug report, see: https://bugs.llvm.org/show_bug.cgi?id=34943 Differential Revision: https://reviews.llvm.org/D38922 llvm-svn: 316830
* [Analyzer] Remove unnecessary semicolon in analyzer tests.George Karpenkov2017-10-251-1/+1
| | | | llvm-svn: 316538
* [Analyzer] Handle implicit function reference in bodyfarming std::call_onceGeorge Karpenkov2017-10-241-0/+13
| | | | | | Differential Revision: https://reviews.llvm.org/D39201 llvm-svn: 316402
* [analyzer] Fix handling of labels in getLValueElementAlexander Shaposhnikov2017-10-231-0/+5
| | | | | | | | | | | In getLValueElement Base may represent the address of a label (as in the newly-added test case), in this case it's not a loc::MemRegionVal and Base.castAs<loc::MemRegionVal>() triggers an assert, this diff makes getLValueElement return UnknownVal instead. Differential revision: https://reviews.llvm.org/D39174 llvm-svn: 316399
* [Analyzer] Correctly handle parameters passed by reference when bodyfarming ↵George Karpenkov2017-10-201-0/+41
| | | | | | | | | | std::call_once Explicitly not supporting functor objects. Differential Revision: https://reviews.llvm.org/D39031 llvm-svn: 316249
* [analyzer] Dump signed integers in SymIntExpr and IntSymExpr correctlyGabor Horvath2017-10-191-0/+1
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D39048 llvm-svn: 316157
* [Analyzer] Always use non-reference types when creating expressions in BodyFarm.George Karpenkov2017-10-171-1/+1
| | | | | | | | | | | | | | Remove an option to use a reference type (on by default!) since a non-reference type is always needed for creating expressions, functions with multiple boolean parameters are very hard to use, and in general it was just a booby trap for further crashes. Furthermore, generalize call_once test case to fix some of the crashes mentioned https://bugs.llvm.org/show_bug.cgi?id=34869 Also removes std::call_once crash. Differential Revision: https://reviews.llvm.org/D39015 llvm-svn: 316041
* [Sema] Re-land: Diagnose tautological comparison with type's min/max valuesRoman Lebedev2017-10-152-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | The first attempt, rL315614 was reverted because one libcxx test broke, and i did not know at the time how to deal with it. Summary: Currently, clang only diagnoses completely out-of-range comparisons (e.g. `char` and constant `300`), and comparisons of unsigned and `0`. But gcc also does diagnose the comparisons with the `std::numeric_limits<>::max()` / `std::numeric_limits<>::min()` so to speak Finally Fixes https://bugs.llvm.org/show_bug.cgi?id=34147 Continuation of https://reviews.llvm.org/D37565 Reviewers: rjmccall, rsmith, aaron.ballman Reviewed By: rsmith Subscribers: rtrieu, jroelofs, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D38101 llvm-svn: 315875
* [analyzer] pr28449: Fix support for various array initializers.Artem Dergachev2017-10-132-0/+18
| | | | | | | | | | | | | | | | | | In some cases the analyzer didn't expect an array-type variable to be initialized with anything other than a string literal. The patch essentially removes the assertion, and ensures relatively sane behavior. There is a bigger problem with these initializers. Currently our memory model (RegionStore) is being ordered to initialize the array with a region that is assumed to be storing the initializer rvalue, and it guesses to copy the contents of that region to the array variable. However, it would make more sense for RegionStore to receive the correct initializer in the first place. This problem isn't addressed with this patch. rdar://problem/27248428 Differential Revision: https://reviews.llvm.org/D23963 llvm-svn: 315750
* [analyzer] CStringChecker: pr34460: Avoid a crash when a cast is not modeled.Artem Dergachev2017-10-132-0/+67
| | | | | | | | | | | | | | | | | The checker used to crash when a mempcpy's length argument is symbolic. In this case the cast from 'void *' to 'char *' failed because the respective ElementRegion that represents cast is hard to add on top of the existing ElementRegion that represents the offset to the last copied byte, while preseving a sane memory region structure. Additionally, a few test cases are added (to casts.c) which demonstrate problems caused by existing sloppy work we do with multi-layer ElementRegions. If said cast would be modeled properly in the future, these tests would need to be taken into account. Differential Revision: https://reviews.llvm.org/D38797 llvm-svn: 315742
* [analyzer] RetainCount: Ignore annotations on user-made CFRetain wrappers.Artem Dergachev2017-10-131-0/+72
| | | | | | | | | | | | | It is not uncommon for the users to make their own wrappers around CoreFoundation's CFRetain and CFRelease functions that are defensive against null references. In such cases CFRetain is often incorrectly marked as CF_RETURNS_RETAINED. Ignore said annotation and treat such wrappers similarly to the regular CFRetain. rdar://problem/31699502 Differential Revision: https://reviews.llvm.org/D38877 llvm-svn: 315736
* [Analyzer] Assume that CFBooleanRef const globals are non-nullGeorge Karpenkov2017-10-131-1/+14
| | | | | | Differential Revision: https://reviews.llvm.org/D38867 llvm-svn: 315655
* Revert "[Sema] Diagnose tautological comparison with type's min/max values"Roman Lebedev2017-10-122-3/+3
| | | | | | | | | | | | | | | | | | | | | This reverts r315614,r315615,r315621,r315622 Breaks http://bb9.pgr.jp/#/builders/20/builds/59 /home/bb9/bootstrap-clang-libcxx-lld-i686-linux/llvm-project/libcxx/test/std/experimental/filesystem/fs.op.funcs/fs.op.last_write_time/last_write_time.pass.cpp:95:17: error: comparison 'long long' > 9223372036854775807 is always false [-Werror,-Wtautological-constant-compare] if (max_sec > Lim::max()) return false; ~~~~~~~ ^ ~~~~~~~~~~ /home/bb9/bootstrap-clang-libcxx-lld-i686-linux/llvm-project/libcxx/test/std/experimental/filesystem/fs.op.funcs/fs.op.last_write_time/last_write_time.pass.cpp:124:13: error: comparison 'long long' < -9223372036854775808 is always false [-Werror,-Wtautological-constant-compare] if (sec < Lim::min() || sec > Lim::max()) return false; ~~~ ^ ~~~~~~~~~~ /home/bb9/bootstrap-clang-libcxx-lld-i686-linux/llvm-project/libcxx/test/std/experimental/filesystem/fs.op.funcs/fs.op.last_write_time/last_write_time.pass.cpp:124:33: error: comparison 'long long' > 9223372036854775807 is always false [-Werror,-Wtautological-constant-compare] if (sec < Lim::min() || sec > Lim::max()) return false; ~~~ ^ ~~~~~~~~~~ 3 errors generated. -- I'm not yet sure what is the proper fix. llvm-svn: 315631
* [Analysis] Un-silence -Wtautological-unsigned-zero-compare in null-deref-ps.cRoman Lebedev2017-10-121-2/+2
| | | | | | | | Stage-2 builds failed: error: 'warning' diagnostics expected but not seen: File /home/buildbot/modules-slave-2/clang-x86_64-linux-selfhost-modules-2/llvm.src/tools/clang/test/Analysis/null-deref-ps.c Line 238: always true llvm-svn: 315622
* [Analysis] Silence -Wtautological-constant-compare in two testsRoman Lebedev2017-10-122-3/+3
| | | | | | | Yes, did not check that. Need to do better :( I do not believe it makes sense to do expect that warning here. llvm-svn: 315615
* [Analyzer] Support bodyfarming libstdc++ implementation of std::call_once.George Karpenkov2017-10-111-1/+10
| | | | | | Differential Revision: https://reviews.llvm.org/D38810 llvm-svn: 315508
* [Analyzer] Assume that string-like const globals are non-nil.George Karpenkov2017-10-111-0/+90
| | | | | | Differential Revision: https://reviews.llvm.org/D38764 llvm-svn: 315488
* [Analyzer] Clarify error messages for undefined resultDaniel Marjamaki2017-10-111-3/+17
| | | | | | Differential Revision: https://reviews.llvm.org/D30295 llvm-svn: 315462
* [analyzer] MisusedMovedObject: Fix state-resetting a base-class sub-object.Artem Dergachev2017-10-101-0/+8
| | | | | | | | | | | If a method is resetting the state of an object that was moved from, it should be safe to use this object again. However if the method was defined in a parent class, but used in a child class, the reset didn't happen from the checker's perspective. Differential Revision: https://reviews.llvm.org/D31538 llvm-svn: 315301
* [analyzer] Implement pointer arithmetic on constantsGabor Horvath2017-10-101-0/+30
| | | | | | | | Patch by: Rafael Stahl! Differential Revision: https://reviews.llvm.org/D37478 llvm-svn: 315296
* [Analyzer] Do not segfault on unexpected call_once implementationGeorge Karpenkov2017-10-091-0/+9
| | | | | | | | Fixes https://bugs.llvm.org/show_bug.cgi?id=34869 Differential Revision: https://reviews.llvm.org/D38702 llvm-svn: 315250
* [analyzer] Fix leak false positives on stuff put in C++/ObjC initializer lists.Artem Dergachev2017-10-053-1/+71
| | | | | | | | | | | | | | | The analyzer now realizes that C++ std::initializer_list objects and Objective-C boxed structure/array/dictionary expressions can potentially maintain a reference to the objects that were put into them. This avoids false memory leak posivites and a few other issues. This is a conservative behavior; for now, we do not model what actually happens to the objects after being passed into such initializer lists. rdar://problem/32918288 Differential Revision: https://reviews.llvm.org/D35216 llvm-svn: 314975
* [analyzer] Fix autodetection of binding types.Artem Dergachev2017-10-043-1/+32
| | | | | | | | | | | | | | | | | | | | | | | In ProgramState::getSVal(Location, Type) API which dereferences a pointer value, when the optional Type parameter is not supplied and the Location is not typed, type should have been guessed on a best-effort basis by inspecting the Location more deeply. However, this never worked; the auto-detected type was instead a pointer type to the correct type. Fixed the issue and added various test cases to demonstrate which parts of the analyzer were affected (uninitialized pointer argument checker, C++ trivial copy modeling, Google test API modeling checker). Additionally, autodetected void types are automatically replaced with char, in order to simplify checker APIs. Which means that if the location is a void pointer, getSVal() would read the first byte through this pointer and return its symbolic value. Fixes pr34305. Differential Revision: https://reviews.llvm.org/D38358 llvm-svn: 314910
* [Analyzer] Re-apply r314820 with a fix for StringRef lifetime.George Karpenkov2017-10-031-0/+7
| | | | | | | | | Fixes the test failure: temporary is now bound to std::string, tests fully pass on Linux. This reverts commit b36ee0924038e1d95ea74230c62d46e05f80587e. llvm-svn: 314859
* Revert r314820 "[Analyzer] More granular special casing in RetainCountChecker"Tim Shen2017-10-031-7/+0
| | | | | | | | The test retain-release.m fails with this patch. Differential Revision: https://reviews.llvm.org/D38487 llvm-svn: 314831
* [Analyzer] More granular special casing in RetainCountCheckerGeorge Karpenkov2017-10-031-0/+7
| | | | | | | | | Only assume that IOBSDNameMatching and friends increment a reference counter if their return type is a CFMutableDictionaryRef. Differential Revision: https://reviews.llvm.org/D38487 llvm-svn: 314820
* [Analyzer] Add dummy implementation to call_once to avoid linkage warnings ↵George Karpenkov2017-09-301-3/+3
| | | | | | in tests. llvm-svn: 314580
* [Analyzer] Synthesize function body for std::call_onceGeorge Karpenkov2017-09-301-0/+233
| | | | | | Differential Revision: https://reviews.llvm.org/D37840 llvm-svn: 314571
* [analyzer] Fix an outdated comment in a test. NFC.Artem Dergachev2017-09-271-2/+1
| | | | llvm-svn: 314298
* [analyzer] Match more patterns in bugreporter::getDerefExpr() API.Artem Dergachev2017-09-273-16/+63
| | | | | | | | | | This function can now track null pointer through simple pointer arithmetic, such as '*&*(p + 2)' => 'p' and so on, displaying intermediate diagnostic pieces for the user to understand where the null pointer is coming from. Differential Revision: https://reviews.llvm.org/D37025 llvm-svn: 314290
* [analyzer] Fix and refactor bugreporter::getDerefExpr() API.Artem Dergachev2017-09-273-0/+275
| | | | | | | | | | | | | | | | | | | | This API is used by checkers (and other entities) in order to track where does a value originate from, by jumping from an expression value of which is equal to that value to the expression from which this value has "appeared". For example, it may be an lvalue from which the rvalue was loaded, or a function call from which the dereferenced pointer was returned. The function now avoids incorrectly unwrapping implicit lvalue-to-rvalue casts, which caused crashes and incorrect intermediate diagnostic pieces. It also no longer relies on how the expression is written when guessing what it means. Fixes pr34373 and pr34731. rdar://problem/33594502 Differential Revision: https://reviews.llvm.org/D37023 llvm-svn: 314287
* [analyzer] Fix crash on modeling of pointer arithmeticAlexander Shaposhnikov2017-09-251-0/+6
| | | | | | | | | | | | | | | | | | | This patch fixes analyzer's crash on the newly added test case (see also https://bugs.llvm.org/show_bug.cgi?id=34374). Pointers subtraction appears to be modeled incorrectly in the following example: char* p; auto n = p - reinterpret_cast<char*>((unsigned long)1); In this case the analyzer (built without this patch) tries to create a symbolic value for the difference treating reinterpret_cast<char*>((unsigned long)1) as an integer, that is not correct. Differential revision: https://reviews.llvm.org/D38214 Test plan: make check-all llvm-svn: 314141
* Add Cross Translation Unit support libraryGabor Horvath2017-09-221-0/+7
| | | | | | | | | | | | | | | | | | This patch introduces a class that can help to build tools that require cross translation unit facilities. This class allows function definitions to be loaded from external AST files based on an index. In order to use this functionality an index is required. The index format is a flat text file but it might be replaced with a different solution in the near future. USRs are used as names to look up the functions definitions. This class also does caching to avoid redundant loading of AST files. Right now only function defnitions can be loaded using this API because this is what the in progress cross translation unit feature of the Static Analyzer requires. In to future this might be extended to classes, types etc. Differential Revision: https://reviews.llvm.org/D34512 llvm-svn: 313975
* [analyzer] Add new delete with non-virtual destructor checkGabor Horvath2017-09-221-0/+187
| | | | | | | | Patch by: Reka Nikolett Kovacs Differential Revision: https://reviews.llvm.org/D35796 llvm-svn: 313973
* [analyzer] Fix an assertion fail in VirtualCallCheckerGabor Horvath2017-09-211-0/+21
| | | | | | Differential Revision: https://reviews.llvm.org/D37978 llvm-svn: 313866
OpenPOWER on IntegriCloud