aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive/Checker.h
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-31Let constraint manager inform checkers that some assumption logic has happend.Zhongxing Xu
Add new states for symbolic regions tracked by malloc checker. This enables us to do malloc checking more accurately. See test case. Based on Lei Zhang's patch and discussion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Migrate the call inliner to the Checker interface.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91991 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-12Add initial support for realloc() in MallocChecker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91216 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Refactor OSAtomic evaluation logic into OSAtomicChecker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90968 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add EvalCallExpr interface to checker, and migrate the no-return functionZhongxing Xu
handler to this interface. GRExprEngine::CheckerEvalCall() will return true if one of the checkers has processed the node. In the future this might return void when we have some default checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90755 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Rename instance variable to avoid name conflict with parameters, and modify ↵Ted Kremenek
addTransition() to compare the correct state values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90552 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Revert r90546.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90551 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04the assertion says state is not NULL. When state is not NULL, getState() Zhongxing Xu
returns state. So simplify the predicate. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90546 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-02Hard bifurcate the state into nil receiver and non-nil receiver, so thatZhongxing Xu
we don't need to use the DoneEvaluation hack when check for ObjCMessageExpr. PreVisitObjCMessageExpr() only checks for undefined receiver or arguments. Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90296 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-24Cleanups and fixes to the nil-receiver checker, some of it fallout theTed Kremenek
initial transition of the nil-receiver checker to the Checker interface as done in r89745. Some important changes include: 1) We consolidate the BugType object used for nil receiver bug reports, and don't include the type of the returned value in the BugType (which would be wrong if a nil receiver bug was reported more than once) 2) Added a new (temporary) flag to CheckerContext: DoneEvauating. This is used by GRExprEngine when evaluating message expressions to not continue evaluating the message expression if this flag is set. This flag is currently set by the nil receiver checker. This is an intermediate solution to allow the nil-receiver checker to properly work as a plug-in outside of GRExprEngine. Basically, this flag indicates that the entire message expression has been evaluated, not just a precondition (which is what the nil-receiver checker does). This flag *should not* be repurposed for general use, but just to pull more things out of GRExprEngine that already in there as we devise a better interface in the Checker class. 3) Cleaned up the logic in the nil-receiver checker, making the control-flow a lot easier to read. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89804 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-24Refactor NilReceiverStructRet and NilReceiverLargerThanVoidPtrRet into Zhongxing Xu
CallAndMessageChecker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89745 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-23Clean up the Checker API a little more, resolving some hidden bugsTed Kremenek
along the way. Important changes: 1) To generate a sink node, use GenerateSink(); GenerateNode() is for generating regular transitions. This makes the API clearer and also allows us to use the 'bool' option to GenerateNode() for a different purpose. 2) GenerateNode() now automatically adds the generated node to the destination ExplodedNodeSet (autotransition) unless the client specifies otherwise with a bool flag. Several checkers did not call 'addTransition()' after calling 'GenerateNode()', causing the simulation path to be prematurely culled when a non-fail stop bug was encountered. 3) Add variants of GenerateNode()/GenerateSink() that take neither a Stmt* or a GRState*; most callers of GenerateNode() just pass in the same Stmt* as provided when the CheckerContext object is created; we can just use that the majority of the time. This cleanup also allows us to potentially coelesce the APIs for evaluating branches and end-of-paths (which currently directly use builders). 4) addTransition() no longer needs to be called except for a few cases. We now have a variant of addTransition() that takes a GRState*; this allows one to propagate the updated state without caring about generating a new node explicitly. This nicely cleaned up a bunch of cases that called autoTransition() with a bunch of conditional logic surround the call (that common logic has now been swallowed up by addTransition() itself). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89707 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-23Provide out-of-line definition for destructor of Checker.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89688 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-23Initial refactor of UndefBranchChecker. We still use GRBranchNodeBuilderZhongxing Xu
in the checker directly. But I don't have a better approach for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89640 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-20No need to pass the state argument explicitly.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89447 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-17Add EvalEndPath interface to Checker. Now we can check memory leaked at theZhongxing Xu
end of the path. Need to unify interfaces. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89063 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-13Check in a new interface of Checker, which will soon be used.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@87092 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-12Enhance Checker class (and GRExprEngine) to support PostVisitation for ↵Ted Kremenek
CallExprs. No clients (yet). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86949 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-11Refactor DereferenceChecker to use only the new Checker API instead ofTed Kremenek
the old builder API. This percolated a bunch of changes up to the Checker class (where CheckLocation has been renamed VisitLocation) and GRExprEngine. ProgramPoint now has the notion of a "LocationCheck" point (with PreLoad and PreStore respectively), and a bunch of the old ProgramPoints that are no longer used have been removed. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86798 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-07Remove Checker::CheckType() (and instead using ↵Ted Kremenek
CheckerVisitor::PreVisitDeclStmt()), and refactor VLASizeChecker to have only one Checker subclass (not two) and to not use the node builders directly (and instead use the newer CheckerContext). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86329 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-06Add a checker for CWE-466: Return of Pointer Value Outside of Expected Range.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86252 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-06static analyzer: refactor checking logic for returning the address of a ↵Ted Kremenek
stack variable or a garbage value into their own respective subclasses of Checker (and put them in .cpp files where their implementation details are hidden from GRExprEngine). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86215 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-05Modify GRExprEngine::EvalBind() to take both a "store expression" andTed Kremenek
an "assign expression", representing the expressions where the value binding occurs and the assignment takes place respectively. These are largely syntactic clues for better error reporting. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86084 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-04Catch uses of undefined values when they are used in assignment, thus ↵Ted Kremenek
catching such bugs closer to the source. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86003 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-03Pull VLA size checker into its own files. Zhongxing Xu
Split it to two checkers, one for undefined size, the other for zero size, so that we don't need to query the size when emitting the bug report. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85895 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-03Implement: <rdar://problem/6250216> Warn against using -[NSAutoreleasePool ↵Ted Kremenek
release] in GC mode git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85887 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-29Move NullDeref and UndefDeref into their own checker. Zhongxing Xu
Add a CheckLocation() interface to Checker. Now ImplicitNullDeref nodes are cached in NullDerefChecker. More cleanups follow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85471 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-09Remove tabs, and whitespace cleanups.Mike Stump
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81346 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-02Refactor the check for bad divide into a checker.Zhongxing Xu
Also fix a checker context bug: the Dst set is not always empty initially. Because in GRExprEngine::CheckerVisit(), *CurrSet is used repeatedly. So we removed the Dst.empty() condition in ~CheckerContext() when deciding whether to do autotransision. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@80786 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-18Enhance static analyzer diagnostics by introducing a new 'EnhancedBugReporter'Ted Kremenek
which allows custom checks to register callback creator functions for creating BugReporterVisitor objects. This allows various checks to include diagnostics such as 'assuming value is null' with little extra work. Eventually this API should be refactored to be cleaner and more simple. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79302 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06Last step of template cleanup: merge *BuilderImpl to *Builder.Zhongxing Xu
Some Builders need further cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78301 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06As GRState seems general enough, it is time to merge some template classes Zhongxing Xu
and their impl base classes. This can greatly simply some code of the core analysis engine. This patch merges ExplodedNodeImpl into ExplodedNode. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78270 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-28Fix regression in attribute 'nonnull' checking when a transition nodeTed Kremenek
was created but not added to the destination NodeSet. This fixes PR 4630. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77353 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-27Update for LLVM API change.Owen Anderson
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77249 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-24Mark destructor of Checker virtual.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@76924 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-22Add new 'Checker' and 'CheckerVisitor' classes, which represent a more powerfulTed Kremenek
interface to plug in domain-specific checker logic than the current GRSimpleAPICheck interface. The new 'Checker' interface can actually generate new nodes, allowing it to modify the state and refine the analysis (which GRSimpleAPIChecks could not). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@76793 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-02 01:52:41 +0000