aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h7
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h10
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h21
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h28
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h2
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h10
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h36
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h12
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h127
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h22
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h17
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h1
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/Store.h10
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h16
-rw-r--r--lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp6
-rw-r--r--lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp20
-rw-r--r--lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp4
-rw-r--r--lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp8
-rw-r--r--lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/CStringChecker.cpp144
-rw-r--r--lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp8
-rw-r--r--lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/CheckerDocumentation.cpp10
-rw-r--r--lib/StaticAnalyzer/Checkers/ChrootChecker.cpp4
-rw-r--r--lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp4
-rw-r--r--lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp6
-rw-r--r--lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp44
-rw-r--r--lib/StaticAnalyzer/Checkers/IdempotentOperationChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp24
-rw-r--r--lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp22
-rw-r--r--lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/MallocChecker.cpp66
-rw-r--r--lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp8
-rw-r--r--lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/OSAtomicChecker.cpp12
-rw-r--r--lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp4
-rw-r--r--lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp12
-rw-r--r--lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp10
-rw-r--r--lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp102
-rw-r--r--lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp6
-rw-r--r--lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/StreamChecker.cpp46
-rw-r--r--lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp6
-rw-r--r--lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp2
-rw-r--r--lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp24
-rw-r--r--lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp8
-rw-r--r--lib/StaticAnalyzer/Core/BasicConstraintManager.cpp66
-rw-r--r--lib/StaticAnalyzer/Core/BugReporter.cpp6
-rw-r--r--lib/StaticAnalyzer/Core/BugReporterVisitors.cpp12
-rw-r--r--lib/StaticAnalyzer/Core/CheckerContext.cpp2
-rw-r--r--lib/StaticAnalyzer/Core/CheckerManager.cpp14
-rw-r--r--lib/StaticAnalyzer/Core/CoreEngine.cpp16
-rw-r--r--lib/StaticAnalyzer/Core/Environment.cpp2
-rw-r--r--lib/StaticAnalyzer/Core/ExplodedGraph.cpp6
-rw-r--r--lib/StaticAnalyzer/Core/ExprEngine.cpp84
-rw-r--r--lib/StaticAnalyzer/Core/ExprEngineC.cpp38
-rw-r--r--lib/StaticAnalyzer/Core/ExprEngineCXX.cpp16
-rw-r--r--lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp12
-rw-r--r--lib/StaticAnalyzer/Core/ExprEngineObjC.cpp16
-rw-r--r--lib/StaticAnalyzer/Core/ProgramState.cpp60
-rw-r--r--lib/StaticAnalyzer/Core/RangeConstraintManager.cpp56
-rw-r--r--lib/StaticAnalyzer/Core/RegionStore.cpp8
-rw-r--r--lib/StaticAnalyzer/Core/SValBuilder.cpp6
-rw-r--r--lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp16
-rw-r--r--lib/StaticAnalyzer/Core/SimpleConstraintManager.h26
-rw-r--r--lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp16
-rw-r--r--lib/StaticAnalyzer/Core/Store.cpp2
74 files changed, 722 insertions, 713 deletions
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h b/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h
index 42a15370a4..9a699f9b7c 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h
@@ -18,17 +18,10 @@
#include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
-#include "clang/AST/ASTContext.h"
-#include "llvm/ADT/FoldingSet.h"
-#include "llvm/ADT/APSInt.h"
-#include "llvm/ADT/ImmutableList.h"
namespace clang {
-
namespace ento {
-class ProgramState;
-
class CompoundValData : public llvm::FoldingSetNode {
QualType T;
llvm::ImmutableList<SVal> L;
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
index eef5461f2d..71d8b3b749 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
@@ -55,7 +55,7 @@ public:
/// the state of the program before the checker ran. Note, checkers should
/// not retain the node in their state since the nodes might get invalidated.
ExplodedNode *getPredecessor() { return Pred; }
- const ProgramState *getState() const { return Pred->getState(); }
+ ProgramStateRef getState() const { return Pred->getState(); }
/// \brief Returns the number of times the current block has been visited
/// along the analyzed path.
@@ -111,7 +111,7 @@ public:
/// tag is specified, a default tag, unique to the given checker,
/// will be used. Tags are used to prevent states generated at
/// different sites from caching out.
- ExplodedNode *addTransition(const ProgramState *State,
+ ExplodedNode *addTransition(ProgramStateRef State,
const ProgramPointTag *Tag = 0) {
return addTransitionImpl(State, false, 0, Tag);
}
@@ -131,7 +131,7 @@ public:
/// @param Tag The tag to uniquely identify the creation site.
/// @param IsSink Mark the new node as sink, which will stop exploration of
/// the given path.
- ExplodedNode *addTransition(const ProgramState *State,
+ ExplodedNode *addTransition(ProgramStateRef State,
ExplodedNode *Pred,
const ProgramPointTag *Tag = 0,
bool IsSink = false) {
@@ -140,7 +140,7 @@ public:
/// \brief Generate a sink node. Generating sink stops exploration of the
/// given path.
- ExplodedNode *generateSink(const ProgramState *state = 0) {
+ ExplodedNode *generateSink(ProgramStateRef state = 0) {
return addTransitionImpl(state ? state : getState(), true);
}
@@ -177,7 +177,7 @@ public:
StringRef getMacroNameOrSpelling(SourceLocation &Loc);
private:
- ExplodedNode *addTransitionImpl(const ProgramState *State,
+ ExplodedNode *addTransitionImpl(ProgramStateRef State,
bool MarkAsSink,
ExplodedNode *P = 0,
const ProgramPointTag *Tag = 0) {
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h b/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h
index f52ee2dc01..b16f049441 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h
@@ -22,46 +22,43 @@ class APSInt;
}
namespace clang {
-
namespace ento {
-class ProgramState;
-class ProgramStateManager;
class SubEngine;
class ConstraintManager {
public:
virtual ~ConstraintManager();
- virtual const ProgramState *assume(const ProgramState *state,
+ virtual ProgramStateRef assume(ProgramStateRef state,
DefinedSVal Cond,
bool Assumption) = 0;
- std::pair<const ProgramState*, const ProgramState*>
- assumeDual(const ProgramState *state, DefinedSVal Cond)
+ std::pair<ProgramStateRef , ProgramStateRef >
+ assumeDual(ProgramStateRef state, DefinedSVal Cond)
{
- std::pair<const ProgramState*, const ProgramState*> res =
+ std::pair<ProgramStateRef , ProgramStateRef > res =
std::make_pair(assume(state, Cond, true), assume(state, Cond, false));
assert(!(!res.first && !res.second) && "System is over constrained.");
return res;
}
- virtual const llvm::APSInt* getSymVal(const ProgramState *state,
+ virtual const llvm::APSInt* getSymVal(ProgramStateRef state,
SymbolRef sym) const = 0;
- virtual bool isEqual(const ProgramState *state,
+ virtual bool isEqual(ProgramStateRef state,
SymbolRef sym,
const llvm::APSInt& V) const = 0;
- virtual const ProgramState *removeDeadBindings(const ProgramState *state,
+ virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,
SymbolReaper& SymReaper) = 0;
- virtual void print(const ProgramState *state,
+ virtual void print(ProgramStateRef state,
raw_ostream &Out,
const char* nl,
const char *sep) = 0;
- virtual void EndPath(const ProgramState *state) {}
+ virtual void EndPath(ProgramStateRef state) {}
protected:
/// canReasonAbout - Not all ConstraintManagers can accurately reason about
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
index 041a60f60e..f393fd1ba0 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
@@ -79,7 +79,7 @@ private:
BlocksAborted blocksAborted;
void generateNode(const ProgramPoint &Loc,
- const ProgramState *State,
+ ProgramStateRef State,
ExplodedNode *Pred);
void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
@@ -128,10 +128,10 @@ public:
/// ExecuteWorkList - Run the worklist algorithm for a maximum number of
/// steps. Returns true if there is still simulation state on the worklist.
bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
- const ProgramState *InitState);
+ ProgramStateRef InitState);
void ExecuteWorkListWithInitialState(const LocationContext *L,
unsigned Steps,
- const ProgramState *InitState,
+ ProgramStateRef InitState,
ExplodedNodeSet &Dst);
// Functions for external checking of whether we have unfinished work
@@ -237,7 +237,7 @@ protected:
virtual void finalizeResults() {}
ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
- const ProgramState *State,
+ ProgramStateRef State,
ExplodedNode *Pred,
bool MarkAsSink = false);
@@ -262,7 +262,7 @@ public:
/// When a node is marked as sink, the exploration from the node is stopped -
/// the node becomes the last node on the path.
ExplodedNode *generateNode(const ProgramPoint &PP,
- const ProgramState *State,
+ ProgramStateRef State,
ExplodedNode *Pred,
bool MarkAsSink = false) {
return generateNodeImpl(PP, State, Pred, MarkAsSink);
@@ -310,7 +310,7 @@ public:
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet,
const NodeBuilderContext &Ctx, ProgramPoint &L)
: NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
- ExplodedNode *generateNode(const ProgramState *State,
+ ExplodedNode *generateNode(ProgramStateRef State,
ExplodedNode *Pred,
const ProgramPointTag *Tag = 0,
bool MarkAsSink = false) {
@@ -358,7 +358,7 @@ public:
ExplodedNode *generateNode(const Stmt *S,
ExplodedNode *Pred,
- const ProgramState *St,
+ ProgramStateRef St,
bool MarkAsSink = false,
const ProgramPointTag *tag = 0,
ProgramPoint::Kind K = ProgramPoint::PostStmtKind){
@@ -369,7 +369,7 @@ public:
ExplodedNode *generateNode(const ProgramPoint &PP,
ExplodedNode *Pred,
- const ProgramState *State,
+ ProgramStateRef State,
bool MarkAsSink = false) {
return generateNodeImpl(PP, State, Pred, MarkAsSink);
}
@@ -404,7 +404,7 @@ public:
takeNodes(SrcSet);
}
- ExplodedNode *generateNode(const ProgramState *State, bool branch,
+ ExplodedNode *generateNode(ProgramStateRef State, bool branch,
ExplodedNode *Pred);
const CFGBlock *getTargetBlock(bool branch) const {
@@ -458,12 +458,12 @@ public:
iterator end() { return iterator(DispatchBlock.succ_end()); }
ExplodedNode *generateNode(const iterator &I,
- const ProgramState *State,
+ ProgramStateRef State,
bool isSink = false);
const Expr *getTarget() const { return E; }
- const ProgramState *getState() const { return Pred->State; }
+ ProgramStateRef getState() const { return Pred->State; }
const LocationContext *getLocationContext() const {
return Pred->getLocationContext();
@@ -509,14 +509,14 @@ public:
}
ExplodedNode *generateCaseStmtNode(const iterator &I,
- const ProgramState *State);
+ ProgramStateRef State);
- ExplodedNode *generateDefaultCaseNode(const ProgramState *State,
+ ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
bool isSink = false);
const Expr *getCondition() const { return Condition; }
- const ProgramState *getState() const { return Pred->State; }
+ ProgramStateRef getState() const { return Pred->State; }
const LocationContext *getLocationContext() const {
return Pred->getLocationContext();
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h b/include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h
index c58da3ea52..b80213e249 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h
@@ -129,7 +129,7 @@ public:
Environment removeDeadBindings(Environment Env,
SymbolReaper &SymReaper,
- const ProgramState *state);
+ ProgramStateRef state);
};
} // end GR namespace
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
index 76308fa2f3..916babc98b 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
@@ -106,7 +106,7 @@ class ExplodedNode : public llvm::FoldingSetNode {
const ProgramPoint Location;
/// State - The state associated with this node.
- const ProgramState *State;
+ ProgramStateRef State;
/// Preds - The predecessors of this node.
NodeGroup Preds;
@@ -116,7 +116,7 @@ class ExplodedNode : public llvm::FoldingSetNode {
public:
- explicit ExplodedNode(const ProgramPoint &loc, const ProgramState *state,
+ explicit ExplodedNode(const ProgramPoint &loc, ProgramStateRef state,
bool IsSink)
: Location(loc), State(state) {
const_cast<ProgramState*>(State)->incrementReferenceCount();
@@ -146,14 +146,14 @@ public:
return *getLocationContext()->getAnalysis<T>();
}
- const ProgramState *getState() const { return State; }
+ ProgramStateRef getState() const { return State; }
template <typename T>
const T* getLocationAs() const { return llvm::dyn_cast<T>(&Location); }
static void Profile(llvm::FoldingSetNodeID &ID,
const ProgramPoint &Loc,
- const ProgramState *state,
+ ProgramStateRef state,
bool IsSink) {
ID.Add(Loc);
ID.AddPointer(state);
@@ -285,7 +285,7 @@ public:
/// where the 'Location' is a ProgramPoint in the CFG. If no node for
/// this pair exists, it is created. IsNew is set to true if
/// the node was freshly created.
- ExplodedNode *getNode(const ProgramPoint &L, const ProgramState *State,
+ ExplodedNode *getNode(const ProgramPoint &L, ProgramStateRef State,
bool IsSink = false,
bool* IsNew = 0);
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h b/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
index 51173a52ec..2ec0de71f1 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
@@ -61,7 +61,7 @@ class ExprEngine : public SubEngine {
/// CleanedState - The state for EntryNode "cleaned" of all dead
/// variables and symbols (as determined by a liveness analysis).
- const ProgramState *CleanedState;
+ ProgramStateRef CleanedState;
/// currentStmt - The current block-level statement.
const Stmt *currentStmt;
@@ -96,7 +96,7 @@ public:
/// of the function are added into the Dst set, which represent the exit
/// state of the function call.
void ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
- const ProgramState *InitState,
+ ProgramStateRef InitState,
ExplodedNodeSet &Dst) {
Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
}
@@ -135,7 +135,7 @@ public:
/// getInitialState - Return the initial state used for the root vertex
/// in the ExplodedGraph.
- const ProgramState *getInitialState(const LocationContext *InitLoc);
+ ProgramStateRef getInitialState(const LocationContext *InitLoc);
ExplodedGraph& getGraph() { return G; }
const ExplodedGraph& getGraph() const { return G; }
@@ -195,22 +195,22 @@ public:
/// evalAssume - Callback function invoked by the ConstraintManager when
/// making assumptions about state values.
- const ProgramState *processAssume(const ProgramState *state, SVal cond,bool assumption);