aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive/GRExprEngine.h
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-22Process cast according to the cast kind. Prepare for more specific cast Zhongxing Xu
handling (for C++). No functionality change for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94153 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09When binding an rvalue to a reference, create a temporary object. Use Zhongxing Xu
CXXObjectRegion to represent it. In Environment, lookup a literal expression before make up a value for it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93047 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Remove references to 'Checker' and 'GRTransferFuncs' fromTed Kremenek
GRStateManager. Having these references was an abstraction violation, as they really should only be known about GRExprEngine. This change required adding a new 'ProcessAssume' callback in GRSubEngine. GRExprEngine implements this callback by calling 'EvalAssume' on all registered Checker objects as well as the registered GRTransferFunc object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92549 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-31Let constraint manager inform checkers that some assumption logic has happend.Zhongxing Xu
Add new states for symbolic regions tracked by malloc checker. This enables us to do malloc checking more accurately. See test case. Based on Lei Zhang's patch and discussion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a SwitchStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92102 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add CFG support for the condition variable that can appear in IfStmts in C++ ↵Ted Kremenek
mode. Add transfer function support in GRExprEngine for IfStmts with initialized condition variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91987 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add basic support for analyzing CastExprs as lvalues.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91952 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-22Add transfer functions support for visiting an Objective-C message ↵Ted Kremenek
expression as an lvalue when the return type is a C++ reference. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91926 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-18Enhance GRExprEngine::VisitCallExpr() to be used in an lvalue context. ↵Ted Kremenek
Uncovered a new failing test case along the way, but we're making progress on handling C++ references in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91710 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Convert GRExprEngine::VisitCallExpr() to use a worklist instead of recursion ↵Ted Kremenek
to evaluate the arguments of a CallExpr. This simplifies the logic and makes it easier to read. (it also avoids any issues with blowing out the stack if the CallExpr had a ridiculous number of arguments) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91613 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu
attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91535 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91517 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add (initial?) static analyzer support for handling C++ references.Ted Kremenek
This change was a lot bigger than I originally anticipated; among other things it requires us storing more information in the CFG to record what block-level expressions need to be evaluated as lvalues. The big change is that CFGBlocks no longer contain Stmt*'s by CFGElements. Currently CFGElements just wrap Stmt*, but they also store a bit indicating whether the block-level expression should be evalauted as an lvalue. DeclStmts involving the initialization of a reference require us treating the initialization expression as an lvalue, even though that information isn't recorded in the AST. Conceptually this change isn't that complicated, but it required bubbling up the data through the CFGBuilder, to GRCoreEngine, and eventually to GRExprEngine. The addition of CFGElement is also useful for when we want to handle more control-flow constructs or other data we want to keep in the CFG that isn't represented well with just a block of statements. In GRExprEngine, this patch introduces logic for evaluating the lvalues of references, which currently retrieves the internal "pointer value" that the reference represents. EvalLoad does a two stage load to catch null dereferences involving an invalid reference (although this could possibly be caught earlier during the initialization of a reference). Symbols are currently symbolicated using the reference type, instead of a pointer type, and special handling is required creating ElementRegions that layer on SymbolicRegions (see the changes to RegionStoreManager). Along the way, the DeadStoresChecker also silences warnings involving dead stores to references. This was the original change I introduced (which I wrote test cases for) that I realized caused GRExprEngine to crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91501 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add analysis support for blocks. This includes a few key changes:Ted Kremenek
- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters. - VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference) - Add transfer function support to GRExprEngine for BlockDeclRefExprs. This change also supports analyzing blocks as an analysis entry point (top-of-the-stack), which required pushing more context-sensitivity around in the MemRegion hierarchy via the use of LocationContext objects. Functionally almost everything is the same, except we track LocationContexts in a few more areas and StackSpaceRegions now refer to a StackFrameContext object. In the future we will need to modify MemRegionManager to allow multiple StackSpaceRegions in flight at once (for the analysis of multiple stack frames). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90809 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add EvalCallExpr interface to checker, and migrate the no-return functionZhongxing Xu
handler to this interface. GRExprEngine::CheckerEvalCall() will return true if one of the checkers has processed the node. In the future this might return void when we have some default checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90755 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-02Hard bifurcate the state into nil receiver and non-nil receiver, so thatZhongxing Xu
we don't need to use the DoneEvaluation hack when check for ObjCMessageExpr. PreVisitObjCMessageExpr() only checks for undefined receiver or arguments. Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90296 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Make RegisterInternalChecks() part of GRExprEngine's private implementation ↵Ted Kremenek
by making it a static function within GRExprEngine.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89884 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25UndefResults is not needed.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89834 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Add transfer function support for BlockExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89829 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-24Cleanups and fixes to the nil-receiver checker, some of it fallout theTed Kremenek
initial transition of the nil-receiver checker to the Checker interface as done in r89745. Some important changes include: 1) We consolidate the BugType object used for nil receiver bug reports, and don't include the type of the returned value in the BugType (which would be wrong if a nil receiver bug was reported more than once) 2) Added a new (temporary) flag to CheckerContext: DoneEvauating. This is used by GRExprEngine when evaluating message expressions to not continue evaluating the message expression if this flag is set. This flag is currently set by the nil receiver checker. This is an intermediate solution to allow the nil-receiver checker to properly work as a plug-in outside of GRExprEngine. Basically, this flag indicates that the entire message expression has been evaluated, not just a precondition (which is what the nil-receiver checker does). This flag *should not* be repurposed for general use, but just to pull more things out of GRExprEngine that already in there as we devise a better interface in the Checker class. 3) Cleaned up the logic in the nil-receiver checker, making the control-flow a lot easier to read. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89804 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-24Refactor NilReceiverStructRet and NilReceiverLargerThanVoidPtrRet into Zhongxing Xu
CallAndMessageChecker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89745 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-21Pull BadCallChecker int UndefinedArgChecker, and have UndefinedArgChecker ↵Ted Kremenek
also handled undefined receivers in message expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89524 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-21More checker refactoring. Passing undefined values in a message expression ↵Ted Kremenek
is now handled by UndefinedArgChecker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89519 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-19Fix 80 col. violation.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89382 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-16* Do the same thing to the basicstore as in r84163.Zhongxing Xu
* Add a load type to GRExprEngine::EvalLoad(). * When retrieve from 'theValue' of OSAtomic funcitions, use the type of the region instead of the argument expression as the load type. * Then we can convert CastRetrievedSVal to a pure assertion. In the future we can let all Retrieve() methods simply return SVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88888 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-14Move definition of GRExprEngine::ProcessEndPath() out-of-line.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88729 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-12Remove GRExprEngine::EvalCall(). It had a single callsite in GRExprEngine, ↵Ted Kremenek
and was easily inlined. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86948 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-11Remove some stale ErrorNodes variables in GRExprEngine and the old buffer ↵Ted Kremenek
overflow logic in GRExprEngineInternalChecks.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86877 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-11Refactor DereferenceChecker to use only the new Checker API instead ofTed Kremenek
the old builder API. This percolated a bunch of changes up to the Checker class (where CheckLocation has been renamed VisitLocation) and GRExprEngine. ProgramPoint now has the notion of a "LocationCheck" point (with PreLoad and PreStore respectively), and a bunch of the old ProgramPoints that are no longer used have been removed. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86798 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-09Remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86512 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-06static analyzer: refactor checking logic for returning the address of a ↵Ted Kremenek
stack variable or a garbage value into their own respective subclasses of Checker (and put them in .cpp files where their implementation details are hidden from GRExprEngine). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86215 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-05Modify GRExprEngine::EvalBind() to take both a "store expression" andTed Kremenek
an "assign expression", representing the expressions where the value binding occurs and the assignment takes place respectively. These are largely syntactic clues for better error reporting. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86084 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-04Catch uses of undefined values when they are used in assignment, thus ↵Ted Kremenek
catching such bugs closer to the source. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86003 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-04Refactor StoreManager::BindDecl() to take a VarRegion* instead of a ↵Ted Kremenek
VarDecl*, and modify GRExprEngine::EvalBind() to handle decl initialization as well. This paves the way for adding "checker" visitation in EvalBind(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85983 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-02Remove GRExprEngine::CheckerVisitLocation(). It was only called in one ↵Ted Kremenek
place, so we inlined it in to GRExprEngine::EvalLocation(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85838 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-30Make checkers run in deterministic order.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85597 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-30Fix PR5316: make assignment expressions can be visited as lvalue. Then we Zhongxing Xu
can get the correct base lvalue. Revert r85578. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85579 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-29Move NullDeref and UndefDeref into their own checker. Zhongxing Xu
Add a CheckLocation() interface to Checker. Now ImplicitNullDeref nodes are cached in NullDerefChecker. More cleanups follow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85471 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-06Fix: <rdar://problem/7275774> Static analyzer warns about NULL pointer whenTed Kremenek
adding assert This fix required a few changes: SimpleSValuator: - Eagerly replace a symbolic value with its constant value in EvalBinOpNN when it is constrained to a constant. This allows us to better constant fold values along a path. - Handle trivial case of '<', '>' comparison of pointers when the two pointers are exactly the same. RegionStoreManager: git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83358 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-16Remove ImplicitBadDivides/ExplicitBadDivides node sets. This checking is ↵Ted Kremenek
now down by a 'Checker' and not build into GRExprEngine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82017 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-11Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a wayTed Kremenek
to statically type various methods in SValuator/GRState as required either a defined value or a defined-but-possibly-unknown value. This leads to various logic cleanups in GRExprEngine, and lets the compiler enforce via type checking our assumptions about what symbolic values are possibly undefined and what are not. Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81579 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-09Remove tabs, and whitespace cleanups.Mike Stump
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81346 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-05Refactor builtin function evaluation code into its own function.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81061 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-27Remove a unused member variable. Instead query the option from AnalysisManager.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@80226 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Move logic of GRExprEngine::EvalBinOp to SValuator::EvalBinOp.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@80018 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Remove CodeDecl and CFG from GRExprEngine and GRStateManager.Zhongxing Xu
Now AnalysisManager is the only place we can get CodeDecl. This leads to an API change: GRState::bindExpr() now takes the CFG argument. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79980 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Remove Decl and CFG from ExplodedGraph. This leads to a series small changes.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79973 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-21Remove 'AnalysisContext::setDecl()', as we the Decl associated with anTed Kremenek
AnalysisContext should never change. Along the way, propagate some constness around. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79701 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-17To make the analysis independent on the locally stored liveness and cfgZhongxing Xu
of GRStateManager and GRExprEngine, pass the initial location context to the getInitialState() method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79228 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-01 13:59:05 +0000