aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive/ExplodedGraph.h
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-19Remove ';' after method definition. Noticed by clang++, which one would thinkDaniel Dunbar
would have a higher respect for its own code. This is getting old, is this warning really adding value? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91779 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-24Cleanups and fixes to the nil-receiver checker, some of it fallout theTed Kremenek
initial transition of the nil-receiver checker to the Checker interface as done in r89745. Some important changes include: 1) We consolidate the BugType object used for nil receiver bug reports, and don't include the type of the returned value in the BugType (which would be wrong if a nil receiver bug was reported more than once) 2) Added a new (temporary) flag to CheckerContext: DoneEvauating. This is used by GRExprEngine when evaluating message expressions to not continue evaluating the message expression if this flag is set. This flag is currently set by the nil receiver checker. This is an intermediate solution to allow the nil-receiver checker to properly work as a plug-in outside of GRExprEngine. Basically, this flag indicates that the entire message expression has been evaluated, not just a precondition (which is what the nil-receiver checker does). This flag *should not* be repurposed for general use, but just to pull more things out of GRExprEngine that already in there as we devise a better interface in the Checker class. 3) Cleaned up the logic in the nil-receiver checker, making the control-flow a lot easier to read. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89804 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-07Change ExplodedNode to have its NodeGroups all BumpPtrAllocated, avoiding ↵Ted Kremenek
malloc() traffic when adding successors/predecessors to a node. This was done by introducing BumpVector, which is essentially SmallVector with all memory being BumpPtrAllocated (this can certainly be cleaned up or moved into llvm/ADT). This change yields a 1.8% speed increase when running the analyzer (with -analyzer-store=region) on a small benchmark file. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83439 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-10Make AnalysisManager stateless. Now other analyzer components only depends onZhongxing Xu
local node information. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81433 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-09Remove tabs, and whitespace cleanups.Mike Stump
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81346 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Remove CodeDecl and CFG from GRExprEngine and GRStateManager.Zhongxing Xu
Now AnalysisManager is the only place we can get CodeDecl. This leads to an API change: GRState::bindExpr() now takes the CFG argument. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79980 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Remove Decl and CFG from ExplodedGraph. This leads to a series small changes.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79973 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-21Remove 'AnalysisContext::setDecl()', as we the Decl associated with anTed Kremenek
AnalysisContext should never change. Along the way, propagate some constness around. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79701 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-20Rename: ProgramPoint::getContext() => ProgramPoint::getLocationContext().Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79502 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-15Extend the ProgramPoint to include the context information LocationContext,Zhongxing Xu
which is either a stack frame context of the function or a local scope context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79072 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-12More cleanups.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78782 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06Last step of template cleanup: merge *BuilderImpl to *Builder.Zhongxing Xu
Some Builders need further cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78301 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06Core analysis engine template cleanup step 2:Zhongxing Xu
merge GRCoreEngineImpl and GRCoreEngine. Introduce a new interface class GRSubEngine as the subengine of GRCoreEngine. GRExprEngine subclasses GRSubEngine now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78298 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06Core analysis engine template cleanup step 2: Zhongxing Xu
merge ExplodedGraphImpl and ExplodedGraph. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78291 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-06As GRState seems general enough, it is time to merge some template classes Zhongxing Xu
and their impl base classes. This can greatly simply some code of the core analysis engine. This patch merges ExplodedNodeImpl into ExplodedNode. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@78270 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-22Implement operator= for ExplodedNodeSet.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@76790 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-13Add ExplodedNode utility methods 'getLocationAs()' and 'getFirstPred()'Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@71699 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-18Hooked up the necessary machinery to allow the retain/release checker referenceTed Kremenek
back to the summary used when evaluating the statement associated with a simulation node. This is now being used to help improve the checker's diagnostics. To get things started, the checker now emits a path diagnostic indicating that 'autorelease' is a no-op in GC mode. Some of these changes are exposing further grossness in the interface between BugReporter and the ExplodedGraph::Trim facilities. These really need to be cleaned up one day. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64881 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Overhaul BugReporter interface and implementation. The new interface cleans upTed Kremenek
the ownership of BugTypes and BugReports. Now BugReports are owned by BugTypes, and BugTypes are owned by the BugReporter object. The major functionality change in this patch is that reports are not immediately emitted by a call to BugReporter::EmitWarning (now called EmitReport), but instead of queued up in report "equivalence classes". When BugReporter::FlushReports() is called, it emits one diagnostic per report equivalence class. This provides a nice cleanup with the caching of reports as well as enables the BugReporter engine to select the "best" path for reporting a path-sensitive bug based on all the locations in the ExplodedGraph that the same bug could occur. Along with this patch, Leaks are now coalesced into a common equivalence class by their allocation site, and the "summary" diagnostic for leaks now reports the allocation site as the location of the bug (this may later be augmented to also provide an example location where the leak occurs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63796 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-24More hacking on static analyzer diagnostics. When emitting summary ↵Ted Kremenek
diagnostics the code paths for diagnostics involving paths or single locations are now unified. This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62903 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-27Added "Auditor" interface for auditing the construction of ExplodedGraphs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55403 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-27Make implementation of ExplodedNodeImpl::addPredecessor out-of-line.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55402 91177308-0d34-0410-b5e6-96231b3b80d8
2008-07-10Refactored most of the "Store" piece of ValueState into a Store type. TheTed Kremenek
current store implementation is now encapsulated by BasicStore. These changes prompted some long due constification of ValueState. Much of the diffs in this patch include adding "const" qualifiers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@53423 91177308-0d34-0410-b5e6-96231b3b80d8
2008-04-23When building PathDiagnostics for bug reports, generate a trimmed ↵Ted Kremenek
ExplodedGraph with a single path that BugReport objects can safely walk and introspect. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@50194 91177308-0d34-0410-b5e6-96231b3b80d8
2008-04-11Added "GREndPathNodeBuilder", a new node builder that will be used forTed Kremenek
evaluating transfer functions at the end-of-path. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@49561 91177308-0d34-0410-b5e6-96231b3b80d8
2008-04-09Major refactoring/cleanup of GRExprEngine, ExplodedGraph, and BugReporter.Ted Kremenek
Bugs are now reported using a combination of "BugType" (previously BugDescription) and Bug "BugReport" objects, which are fed to BugReporter (which generates PathDiagnostics). This provides a far more modular way of registering bug types and plugging in diagnostics. GRExprEngine now owns its copy of GRCoreEngine, and is not owned by the ExplodedGraph. ExplodedGraph is no longer templated on the "checker", but instead on the state contained in the nodes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@49453 91177308-0d34-0410-b5e6-96231b3b80d8
2008-04-03Added node_iterator to ExplodedGraph to allow iteration over all nodes inTed Kremenek
the graph. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@49132 91177308-0d34-0410-b5e6-96231b3b80d8
2008-04-02Fix copy-paste error.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@49076 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-27ProgramPoint is just a smart pointer; no reason to return a constant reference.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@48891 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-14Path-sensitive analyses no longer take a FunctionDecl, but any Decl representingTed Kremenek
a block of "code". Patched various ASTConsumers (such as ASTDumper) to have more support for processing ObjCMethodDecl. CFGVisitor now builds CFGs for ObjCMethodDecls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@48363 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-07Added --trim-path-graph to the driver to trim paths from the ExplodedGraphTed Kremenek
that are not related to error nodes. Fixed bug where we did not detect some NULL dereferences. Added "ExplodedGraph::Trim" to trim all nodes that cannot transitively reach a set of provided nodes. Fixed subtle bug in ExplodedNodeImpl where we could create predecessor iterators that included the mangled "sink" bit. The better fix is to integrate this bit into the void* for the wrapped State, not the NodeGroups representing a node's predecessors and successors. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@48036 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-05Fixed bug that could case unwanted bifurcation of states when evaluating calls.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47964 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-05Fixed a horribly insidious bit-masking bug in the implementation ofTed Kremenek
ExplodedNode that would occasionally result in heap corruption. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47956 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-05Plug-in transfer function "EvalCall" now takes as an argument the currentTed Kremenek
GRStmtNodeBuilder and is now responsible for adding its own nodes to the graph. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47923 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-05Cleaned up typedefs involving StateTy so that we always use "StateTy*" ↵Ted Kremenek
instead of StateTy. This is conceptually much cleaner, as it shows that the state is always a pointer. It also makes it easier to marshall these values around across the internal APIs of the path-sensitive engine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47921 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-04Moved GRExprEngine::NodeSet out of GRExprEngine and made it a standalone ↵Ted Kremenek
class: ExplodedNodeSet. Made GRExprEngine::NodeSet a typedef of ExplodedNodeSet. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47914 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-04Fixed another obscure node-caching bug.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47898 91177308-0d34-0410-b5e6-96231b3b80d8
2008-03-03Fixed subtle caching bug in ExplodedGraph that would cause some nodes toTed Kremenek
be incorrectly merged together. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47851 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-28Merged ValueState and ValueStateImpl into just ValueState, with ↵Ted Kremenek
GRExprEngine::StateTy just becoming ValueState*. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47714 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-18Added "size()" and "empty()" methods to ExplodedGraphImpl.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47289 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-15Simplified transfer function logic for ++/-- operators.Ted Kremenek
Added more boilerplate transfer function support for pointer arithmetic. Added more pretty-printing support for symbolic constraints. Added transfer function support for handling enum values. Minor pointer types cleanup in ExplodedGraphImpl. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47183 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-13Added support to GRCoreEngine/GRExprEngine for processing control-flowTed Kremenek
from switch...case...default statements. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47100 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-13Renamed class GREngine => GRCoreEngine.Ted Kremenek
Renamed class GRConstants => GRExprEngine. This was done with a Perl script, and will result in 80 col. violations that I will gradually fix up. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47070 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-13Added support to GREngine/GRConstants for handling computed gotos.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47038 91177308-0d34-0410-b5e6-96231b3b80d8
2008-02-05ValueManager now uses the BumpPtrAllocator owned by the ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@46740 91177308-0d34-0410-b5e6-96231b3b80d8
2008-01-30Implemented some branch pruning in GRConstants using != and == forTed Kremenek
constant integers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@46581 91177308-0d34-0410-b5e6-96231b3b80d8
2008-01-29Added boilerplate logic in GREngine for processing branches.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@46532 91177308-0d34-0410-b5e6-96231b3b80d8
2008-01-29Renamed GRNodeBuilder to GRStmtNodeBuilder.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@46531 91177308-0d34-0410-b5e6-96231b3b80d8
2008-01-29Driver now passes the top-level FunctionDecl* to GRConstants.Ted Kremenek
Refactoring: for GREngine and GRConstants, pushed references to CFG, ASTContext, and the top-level FunctionDecl into ExplodedGraphImpl. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@46475 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-23 23:33:56 +0000