Split libAnalysis into two libraries: libAnalysis and libChecker.

(1) libAnalysis is a generic analysis library that can be used by
    Sema.  It defines the CFG, basic dataflow analysis primitives, and
    inexpensive flow-sensitive analyses (e.g. LiveVariables).

(2) libChecker contains the guts of the static analyzer, incuding the
    path-sensitive analysis engine and domain-specific checks.

Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.

This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker.  More changes pending.  :)

This change also exposed a layering violation between AnalysisContext
and MemRegion.  BlockInvocationContext shouldn't explicitly know about
BlockDataRegions.  For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet).  We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8

63 files changed, 22572 insertions, 0 deletions

diff --git a/lib/Checker/ArrayBoundChecker.cpp b/lib/Checker/ArrayBoundChecker.cpp
new file mode 100644
index 0000000000..0c3e3e9df4
--- /dev/null
+++ b/lib/Checker/ArrayBoundChecker.cpp
@@ -0,0 +1,91 @@
+//== ArrayBoundChecker.cpp ------------------------------*- C++ -*--==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines ArrayBoundChecker, which is a path-sensitive check
+// which looks for an out-of-bound array element access.
+//
+//===----------------------------------------------------------------------===//
+
+#include "GRExprEngineInternalChecks.h"
+#include "clang/Checker/PathSensitive/GRExprEngine.h"
+#include "clang/Checker/PathSensitive/BugReporter.h"
+#include "clang/Checker/PathSensitive/CheckerVisitor.h"
+
+using namespace clang;
+
+namespace {
+class ArrayBoundChecker : 
+    public CheckerVisitor<ArrayBoundChecker> {      
+  BuiltinBug *BT;
+public:
+    ArrayBoundChecker() : BT(0) {}
+    static void *getTag();
+    void VisitLocation(CheckerContext &C, const Stmt *S, SVal l);
+};
+}
+
+void clang::RegisterArrayBoundChecker(GRExprEngine &Eng) {
+  Eng.registerCheck(new ArrayBoundChecker());
+}
+
+void *ArrayBoundChecker::getTag() {
+  static int x = 0; return &x;
+}
+
+void ArrayBoundChecker::VisitLocation(CheckerContext &C, const Stmt *S, SVal l){
+  // Check for out of bound array element access.
+  const MemRegion *R = l.getAsRegion();
+  if (!R)
+    return;
+
+  R = R->StripCasts();
+
+  const ElementRegion *ER = dyn_cast<ElementRegion>(R);
+  if (!ER)
+    return;
+
+  // Get the index of the accessed element.
+  DefinedOrUnknownSVal &Idx = cast<DefinedOrUnknownSVal>(ER->getIndex());
+
+  const GRState *state = C.getState();
+
+  // Get the size of the array.
+  DefinedOrUnknownSVal NumElements 
+    = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(), 
+                                         ER->getValueType(C.getASTContext()));
+
+  const GRState *StInBound = state->AssumeInBound(Idx, NumElements, true);
+  const GRState *StOutBound = state->AssumeInBound(Idx, NumElements, false);
+  if (StOutBound && !StInBound) {
+    ExplodedNode *N = C.GenerateSink(StOutBound);
+    if (!N)
+      return;
+  
+    if (!BT)
+      BT = new BuiltinBug("Out-of-bound array access",
+                       "Access out-of-bound array element (buffer overflow)");
+
+    // FIXME: It would be nice to eventually make this diagnostic more clear,
+    // e.g., by referencing the original declaration or by saying *why* this
+    // reference is outside the range.
+
+    // Generate a report for this bug.
+    RangedBugReport *report = 
+      new RangedBugReport(*BT, BT->getDescription(), N);
+
+    report->addRange(S->getSourceRange());
+    C.EmitReport(report);
+    return;
+  }
+  
+  // Array bound check succeeded.  From this point forward the array bound
+  // should always succeed.
+  assert(StInBound);
+  C.addTransition(StInBound);
+}
diff --git a/lib/Checker/AttrNonNullChecker.cpp b/lib/Checker/AttrNonNullChecker.cpp
new file mode 100644
index 0000000000..c9e0e40af7
--- /dev/null
+++ b/lib/Checker/AttrNonNullChecker.cpp
@@ -0,0 +1,112 @@
+//===--- AttrNonNullChecker.h - Undefined arguments checker ----*- C++ -*--===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This defines AttrNonNullChecker, a builtin check in GRExprEngine that 
+// performs checks for arguments declared to have nonnull attribute.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/Checker/PathSensitive/CheckerVisitor.h"
+#include "clang/Checker/PathSensitive/BugReporter.h"
+#include "GRExprEngineInternalChecks.h"
+
+using namespace clang;
+
+namespace {
+class AttrNonNullChecker
+  : public CheckerVisitor<AttrNonNullChecker> {
+  BugType *BT;
+public:
+  AttrNonNullChecker() : BT(0) {}
+  static void *getTag() {
+    static int x = 0;
+    return &x;
+  }
+  void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
+};
+} // end anonymous namespace
+
+void clang::RegisterAttrNonNullChecker(GRExprEngine &Eng) {
+  Eng.registerCheck(new AttrNonNullChecker());
+}
+
+void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C, 
+                                          const CallExpr *CE) {
+  const GRState *state = C.getState();
+
+  // Check if the callee has a 'nonnull' attribute.
+  SVal X = state->getSVal(CE->getCallee());
+
+  const FunctionDecl* FD = X.getAsFunctionDecl();
+  if (!FD)
+    return;
+
+  const NonNullAttr* Att = FD->getAttr<NonNullAttr>();
+  if (!Att)
+    return;
+
+  // Iterate through the arguments of CE and check them for null.
+  unsigned idx = 0;
+
+  for (CallExpr::const_arg_iterator I=CE->arg_begin(), E=CE->arg_end(); I!=E;
+       ++I, ++idx) {
+
+    if (!Att->isNonNull(idx))
+      continue;
+
+    const SVal &V = state->getSVal(*I);
+    const DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
+
+    if (!DV)
+      continue;
+
+    ConstraintManager &CM = C.getConstraintManager();
+    const GRState *stateNotNull, *stateNull;
+    llvm::tie(stateNotNull, stateNull) = CM.AssumeDual(state, *DV);
+
+    if (stateNull && !stateNotNull) {
+      // Generate an error node.  Check for a null node in case
+      // we cache out.
+      if (ExplodedNode *errorNode = C.GenerateSink(stateNull)) {
+
+        // Lazily allocate the BugType object if it hasn't already been
+        // created. Ownership is transferred to the BugReporter object once
+        // the BugReport is passed to 'EmitWarning'.
+        if (!BT)
+          BT = new BugType("Argument with 'nonnull' attribute passed null",
+                           "API");
+
+        EnhancedBugReport *R =
+          new EnhancedBugReport(*BT,
+                                "Null pointer passed as an argument to a "
+                                "'nonnull' parameter", errorNode);
+
+        // Highlight the range of the argument that was null.
+        const Expr *arg = *I;
+        R->addRange(arg->getSourceRange());
+        R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, arg);
+
+        // Emit the bug report.
+        C.EmitReport(R);
+      }
+
+      // Always return.  Either we cached out or we just emitted an error.
+      return;
+    }
+
+    // If a pointer value passed the check we should assume that it is
+    // indeed not null from this point forward.
+    assert(stateNotNull);
+    state = stateNotNull;
+  }
+
+  // If we reach here all of the arguments passed the nonnull check.
+  // If 'state' has been updated generated a new node.
+  C.addTransition(state);
+}
diff --git a/lib/Checker/BasicConstraintManager.cpp b/lib/Checker/BasicConstraintManager.cpp
new file mode 100644
index 0000000000..e89546ecb0
--- /dev/null
+++ b/lib/Checker/BasicConstraintManager.cpp
@@ -0,0 +1,317 @@
+//== BasicConstraintManager.cpp - Manage basic constraints.------*- C++ -*--==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines BasicConstraintManager, a class that tracks simple
+//  equality and inequality constraints on symbolic values of GRState.
+//
+//===----------------------------------------------------------------------===//
+
+#include "SimpleConstraintManager.h"
+#include "clang/Checker/PathSensitive/GRState.h"
+#include "clang/Checker/PathSensitive/GRStateTrait.h"
+#include "clang/Checker/PathSensitive/GRTransferFuncs.h"
+#include "llvm/Support/raw_ostream.h"
+
+using namespace clang;
+
+
+namespace { class ConstNotEq {}; }
+namespace { class ConstEq {}; }
+
+typedef llvm::ImmutableMap<SymbolRef,GRState::IntSetTy> ConstNotEqTy;
+typedef llvm::ImmutableMap<SymbolRef,const llvm::APSInt*> ConstEqTy;
+
+static int ConstEqIndex = 0;
+static int ConstNotEqIndex = 0;
+
+namespace clang {
+template<>
+struct GRStateTrait<ConstNotEq> : public GRStatePartialTrait<ConstNotEqTy> {
+  static inline void* GDMIndex() { return &ConstNotEqIndex; }
+};
+
+template<>
+struct GRStateTrait<ConstEq> : public GRStatePartialTrait<ConstEqTy> {
+  static inline void* GDMIndex() { return &ConstEqIndex; }
+};
+}
+
+namespace {
+// BasicConstraintManager only tracks equality and inequality constraints of
+// constants and integer variables.
+class BasicConstraintManager
+  : public SimpleConstraintManager {
+  GRState::IntSetTy::Factory ISetFactory;
+public:
+  BasicConstraintManager(GRStateManager &statemgr, GRSubEngine &subengine)
+    : SimpleConstraintManager(subengine), 
+      ISetFactory(statemgr.getAllocator()) {}
+
+  const GRState* AssumeSymNE(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AssumeSymEQ(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AssumeSymLT(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AssumeSymGT(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AssumeSymGE(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AssumeSymLE(const GRState* state, SymbolRef sym,
+                             const llvm::APSInt& V);
+
+  const GRState* AddEQ(const GRState* state, SymbolRef sym, const llvm::APSInt& V);
+
+  const GRState* AddNE(const GRState* state, SymbolRef sym, const llvm::APSInt& V);
+
+  const llvm::APSInt* getSymVal(const GRState* state, SymbolRef sym) const;
+  bool isNotEqual(const GRState* state, SymbolRef sym, const llvm::APSInt& V)
+      const;
+  bool isEqual(const GRState* state, SymbolRef sym, const llvm::APSInt& V)
+      const;
+
+  const GRState* RemoveDeadBindings(const GRState* state, SymbolReaper& SymReaper);
+
+  void print(const GRState* state, llvm::raw_ostream& Out,
+             const char* nl, const char *sep);
+};
+
+} // end anonymous namespace
+
+ConstraintManager* clang::CreateBasicConstraintManager(GRStateManager& statemgr,
+                                                       GRSubEngine &subengine) {
+  return new BasicConstraintManager(statemgr, subengine);
+}
+
+const GRState*
+BasicConstraintManager::AssumeSymNE(const GRState *state, SymbolRef sym,
+                                    const llvm::APSInt& V) {
+  // First, determine if sym == X, where X != V.
+  if (const llvm::APSInt* X = getSymVal(state, sym)) {
+    bool isFeasible = (*X != V);
+    return isFeasible ? state : NULL;
+  }
+
+  // Second, determine if sym != V.
+  if (isNotEqual(state, sym, V))
+    return state;
+
+  // If we reach here, sym is not a constant and we don't know if it is != V.
+  // Make that assumption.
+  return AddNE(state, sym, V);
+}
+
+const GRState *BasicConstraintManager::AssumeSymEQ(const GRState *state,
+                                                   SymbolRef sym,
+                                                   const llvm::APSInt &V) {
+  // First, determine if sym == X, where X != V.
+  if (const llvm::APSInt* X = getSymVal(state, sym)) {
+    bool isFeasible = *X == V;
+    return isFeasible ? state : NULL;
+  }
+
+  // Second, determine if sym != V.
+  if (isNotEqual(state, sym, V))
+    return NULL;
+
+  // If we reach here, sym is not a constant and we don't know if it is == V.
+  // Make that assumption.
+  return AddEQ(state, sym, V);
+}
+
+// These logic will be handled in another ConstraintManager.
+const GRState *BasicConstraintManager::AssumeSymLT(const GRState *state,
+                                                   SymbolRef sym,
+                                                   const llvm::APSInt& V) {
+  // Is 'V' the smallest possible value?
+  if (V == llvm::APSInt::getMinValue(V.getBitWidth(), V.isUnsigned())) {
+    // sym cannot be any value less than 'V'.  This path is infeasible.
+    return NULL;
+  }
+
+  // FIXME: For now have assuming x < y be the same as assuming sym != V;
+  return AssumeSymNE(state, sym, V);
+}
+
+const GRState *BasicConstraintManager::AssumeSymGT(const GRState *state,
+                                                   SymbolRef sym,
+                                                   const llvm::APSInt& V) {
+
+  // Is 'V' the largest possible value?
+  if (V == llvm::APSInt::getMaxValue(V.getBitWidth(), V.isUnsigned())) {
+    // sym cannot be any value greater than 'V'.  This path is infeasible.
+    return NULL;
+  }
+
+  // FIXME: For now have assuming x > y be the same as assuming sym != V;
+  return AssumeSymNE(state, sym, V);
+}
+
+const GRState *BasicConstraintManager::AssumeSymGE(const GRState *state,
+                                                   SymbolRef sym,
+                                                   const llvm::APSInt &V) {
+
+  // Reject a path if the value of sym is a constant X and !(X >= V).
+  if (const llvm::APSInt *X = getSymVal(state, sym)) {
+    bool isFeasible = *X >= V;
+    return isFeasible ? state : NULL;
+  }
+
+  // Sym is not a constant, but it is worth looking to see if V is the
+  // maximum integer value.
+  if (V == llvm::APSInt::getMaxValue(V.getBitWidth(), V.isUnsigned())) {
+    // If we know that sym != V, then this condition is infeasible since
+    // there is no other value greater than V.
+    bool isFeasible = !isNotEqual(state, sym, V);
+
+    // If the path is still feasible then as a consequence we know that
+    // 'sym == V' because we cannot have 'sym > V' (no larger values).
+    // Add this constraint.
+    return isFeasible ? AddEQ(state, sym, V) : NULL;
+  }
+
+  return state;
+}
+
+const GRState*
+BasicConstraintManager::AssumeSymLE(const GRState* state, SymbolRef sym,
+                                    const llvm::APSInt& V) {
+
+  // Reject a path if the value of sym is a constant X and !(X <= V).
+  if (const llvm::APSInt* X = getSymVal(state, sym)) {
+    bool isFeasible = *X <= V;
+    return isFeasible ? state : NULL;
+  }
+
+  // Sym is not a constant, but it is worth looking to see if V is the
+  // minimum integer value.
+  if (V == llvm::APSInt::getMinValue(V.getBitWidth(), V.isUnsigned())) {
+    // If we know that sym != V, then this condition is infeasible since
+    // there is no other value less than V.
+    bool isFeasible = !isNotEqual(state, sym, V);
+
+    // If the path is still feasible then as a consequence we know that
+    // 'sym == V' because we cannot have 'sym < V' (no smaller values).
+    // Add this constraint.
+    return isFeasible ? AddEQ(state, sym, V) : NULL;
+  }
+
+  return state;
+}
+
+const GRState* BasicConstraintManager::AddEQ(const GRState* state, SymbolRef sym,
+                                             const llvm::APSInt& V) {
+  // Create a new state with the old binding replaced.
+  return state->set<ConstEq>(sym, &V);
+}
+
+const GRState* BasicConstraintManager::AddNE(const GRState* state, SymbolRef sym,
+                                             const llvm::APSInt& V) {
+
+  // First, retrieve the NE-set associated with the given symbol.
+  ConstNotEqTy::data_type* T = state->get<ConstNotEq>(sym);
+  GRState::IntSetTy S = T ? *T : ISetFactory.GetEmptySet();
+
+  // Now add V to the NE set.
+  S = ISetFactory.Add(S, &V);
+
+  // Create a new state with the old binding replaced.
+  return state->set<ConstNotEq>(sym, S);
+}
+
+const llvm::APSInt* BasicConstraintManager::getSymVal(const GRState* state,
+                                                      SymbolRef sym) const {
+  const ConstEqTy::data_type* T = state->get<ConstEq>(sym);
+  return T ? *T : NULL;
+}
+
+bool BasicConstraintManager::isNotEqual(const GRState* state, SymbolRef sym,
+                                        const llvm::APSInt& V) const {
+
+  // Retrieve the NE-set associated with the given symbol.
+  const ConstNotEqTy::data_type* T = state->get<ConstNotEq>(sym);
+
+  // See if V is present in the NE-set.
+  return T ? T->contains(&V) : false;
+}
+
+bool BasicConstraintManager::isEqual(const GRState* state, SymbolRef sym,
+                                     const llvm::APSInt& V) const {
+  // Retrieve the EQ-set associated with the given symbol.
+  const ConstEqTy::data_type* T = state->get<ConstEq>(sym);
+  // See if V is present in the EQ-set.
+  return T ? **T == V : false;
+}
+
+/// Scan all symbols referenced by the constraints. If the symbol is not alive
+/// as marked in LSymbols, mark it as dead in DSymbols.
+const GRState*
+BasicConstraintManager::RemoveDeadBindings(const GRState* state,
+                                           SymbolReaper& SymReaper) {
+
+  ConstEqTy CE = state->get<ConstEq>();
+  ConstEqTy::Factory& CEFactory = state->get_context<ConstEq>();
+
+  for (ConstEqTy::iterator I = CE.begin(), E = CE.end(); I!=E; ++I) {
+    SymbolRef sym = I.getKey();
+    if (SymReaper.maybeDead(sym)) CE = CEFactory.Remove(CE, sym);
+  }
+  state = state->set<ConstEq>(CE);
+
+  ConstNotEqTy CNE = state->get<ConstNotEq>();
+  ConstNotEqTy::Factory& CNEFactory = state->get_context<ConstNotEq>();
+
+  for (ConstNotEqTy::iterator I = CNE.begin(), E = CNE.end(); I != E; ++I) {
+    SymbolRef sy