aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive/Store.h
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-18Add support for computing size in elements for symbolic regions obtained fromZhongxing Xu
malloc(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93722 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-11Switch RegionStore over to using <BaseRegion+raw offset> to storeTed Kremenek
value bindings. Along with a small change to OSAtomicChecker, this resolves <rdar://problem/7527292> and resolves some long-standing issues with how values can be bound to the same physical address by not have the same "key". This change is only a beginning; logically RegionStore needs to better handle loads from addresses where the stored value is larger/smaller/different type than the loaded value. We handle these cases in an approximate fashion now (via CastRetrievedVal and help in SimpleSValuator), but it could be made much smarter. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93137 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Make static analysis support for C++ 'this' expression context-sensitive. ↵Ted Kremenek
Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92675 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-19Remove ';' after method definition. Noticed by clang++, which one would thinkDaniel Dunbar
would have a higher respect for its own code. This is getting old, is this warning really adding value? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91779 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu
attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91535 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add analysis support for blocks. This includes a few key changes:Ted Kremenek
- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters. - VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference) - Add transfer function support to GRExprEngine for BlockDeclRefExprs. This change also supports analyzing blocks as an analysis entry point (top-of-the-stack), which required pushing more context-sensitivity around in the MemRegion hierarchy via the use of LocationContext objects. Functionally almost everything is the same, except we track LocationContexts in a few more areas and StackSpaceRegions now refer to a StackFrameContext object. In the future we will need to modify MemRegionManager to allow multiple StackSpaceRegions in flight at once (for the analysis of multiple stack frames). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90809 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-03Add batch version of 'StoreManager::InvalidateRegion()' for invalidating ↵Ted Kremenek
multiple regions as once. After adopting this in the CFRefCount::EvalCall(), we see a reduction in analysis time of 1.5% when analyzing all of SQLite3. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90405 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-16* Do the same thing to the basicstore as in r84163.Zhongxing Xu
* Add a load type to GRExprEngine::EvalLoad(). * When retrieve from 'theValue' of OSAtomic funcitions, use the type of the region instead of the argument expression as the load type. * Then we can convert CastRetrievedSVal to a pure assertion. In the future we can let all Retrieve() methods simply return SVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88888 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-12Make StoreManager::getSizeInElements() always return DefinedOrUnknownSVal.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86932 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-04Refactor StoreManager::BindDecl() to take a VarRegion* instead of a ↵Ted Kremenek
VarDecl*, and modify GRExprEngine::EvalBind() to handle decl initialization as well. This paves the way for adding "checker" visitation in EvalBind(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@85983 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-16retain/release checker: Stop tracking reference counts for any symbols ↵Ted Kremenek
touched by StoreManager::InvalidateRegion(). This fixes <rdar://problem/7257223> and <rdar://problem/7283470>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@84223 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-14Now StoreManager::CastRegion() takes a MemRegion, returns a MemRegion.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@84081 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-14* Remove unused GRState* parameterZhongxing Xu
* Make all Base value the last argument. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@84071 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-13Return the original state by default.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83949 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-13Add an initial implementation of EnterStackFrame() to the StoreManager.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83934 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-09Remove unused code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83612 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-09Remove tabs, and whitespace cleanups.Mike Stump
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81346 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-25Fix crash reported in <rdar://problem/7124210> by "back-porting" some of theTed Kremenek
implicit cast logic in RegionStoreManager to BasicStoreManager. This involved moving CastRetriedVal from RegionStoreManager to StoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@80026 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-21Remove 'SelfRegion' field from both BasicStoreManager and RegionStoreManager.Ted Kremenek
SelfRegion represented the object bound to 'self' (when analyzing Objective-C methods) upon entry to a method. Having this region stored on the side ignores the current stack frame that we might be analyzing (among other things), and is a problem for interprocedural analysis. For RegionStoreManager, the value for SelfRegion is just lazily created. For BasicStoreManager, the value for SelfRegion is bound eagerly to 'self', but no explicit tracking of SelfRegion on the side is made. As part of this change, remove the restriction in BasicStoreManager that we only track ivars for 'self'. This shouldn't actually change anything in terms of precision, and simplifies the logic. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79694 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-21Add LocationContext* field to VarRegion. This is needed for interprocedural ↵Ted Kremenek
analysis. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79680 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-17To make the analysis independent on the locally stored liveness and cfgZhongxing Xu
of GRStateManager and GRExprEngine, pass the initial location context to the getInitialState() method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@79228 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-02Remove RegionViews and RegionCasts. These are no longer used.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77876 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-02Generalize the interface of 'StoreManager::RemoveDeadBindings()' to ↵Ted Kremenek
manipulate the entire GRState, not just the Store. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77870 91177308-0d34-0410-b5e6-96231b3b80d8
2009-08-01This is a fairly large patch, which resulted from a cascade of changesTed Kremenek
made to RegionStore (and related classes) in order to handle some analyzer failures involving casts and manipulation of symbolic memory. The root of the change is in StoreManager::CastRegion(). Instead of using ad hoc heuristics to decide when to layer an ElementRegion on a casted MemRegion, we now always layer an ElementRegion when the cast type is different than the original type of the region. This carries the current cast information associated with a region around without resorting to the error prone recording of "casted types" in GRState. Along with this new policy of layering ElementRegions, I added a new algorithm to strip away existing ElementRegions when they simply represented casts of a base memory object. This algorithm computes the raw "byte offset" that an ElementRegion represents from the base region, and allows the new ElementRegion to be based off that offset. The added benefit is that this naturally handles a series of casts of a MemRegion without building up a set of redundant ElementRegions (thus canonicalizing the region view). Other related changes that cascaded from this one (as tests were failing in RegionStore): - Revamped RegionStoreManager::InvalidateRegion() to completely remove all bindings and default values from a region and all subregions. Now invalidated fields are not bound directly to new symbolic values; instead the base region has a "default" symbol value from which "derived symbols" can be created. The main advantage of this approach is that it allows us to invalidate a region hierarchy and then lazily instantiate new values no matter how deep the hierarchy went (i.e., regardless of the number of field accesses, e.g. x->f->y->z->...). The previous approach did not do this. - Slightly reworked RegionStoreManager::RemoveDeadBindings() to also incorporate live symbols and live regions that do not have direct bindings but also have "default values" used for lazy instantiation. The changes to 'InvalidateRegion' revealed that these were necessary in order to achieve lazy instantiation of values in the region store with those bindings being removed too early. - The changes to InvalidateRegion() and RemoveDeadBindings() revealed a serious bug in 'getSubRegionMap()' where not all region -> subregion relationships involved in actually bindings (explicit and implicit) were being recorded. This has been fixed by using a worklist algorithm to iteratively fill in the region map. - Added special support to RegionStoreManager::Bind()/Retrieve() to handle OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the layering of ElementRegions. - Fixed a bug in SymbolReaper::isLive() where derived symbols were not being marked live if the symbol they were derived from was also live. This fix was critical for getting lazy instantiation in RegionStore to work. - Tidied up the implementation of ValueManager::getXXXSymbolVal() methods to use SymbolManager::canSymbolicate() to decide whether or not a symbol should be symbolicated. - 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been moved to 'test/Analysis/misc-ps.m'. - Tweaked some pretty-printing of MemRegions, and implemented 'ElementRegion::getRawOffset()' for use with the CastRegion changes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77782 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-29Remove 'StoreManager::OldCastRegion()', TypedViewRegion (which onlyTed Kremenek
OldCastRegion used), and the associated command line option '-analyzer-store=old-basic-cast'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77509 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-29Make StoreManager::InvalidateRegion() virtual, move the current implementationTed Kremenek
in StoreManager to RegionStoreManager, and create a special, highly reduced version in BasicStoreManager. These changes are in preparation for future RegionStore-specific changes to InvalidateRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77483 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-21Fix PR 4594 by refactoring almost all casting logic from GRExprEngine::VisitCastTed Kremenek
to SValuator::EvalCast. In the process, the StoreManagers now use this new cast machinery, and the hack in GRExprEngine::EvalBind to handle implicit casts involving OSAtomicCompareAndSwap and friends has been removed (and replaced with logic closer to the logic specific to those functions). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@76641 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-14Instead of recovering from a wrong invalidation, this patch aims to Zhongxing Xu
invalidate the region correctly. It uses the cast-to type to invalidate the region when available. To avoid invalid cast-to type like 'void*' or 'id', region store now only records non-generic casts of regions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@75580 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-10Switch BasicStoreManager to use the new CastRegion implementation by default,Ted Kremenek
and replace the 'clang-cc' option '-analyzer-store=basic-new-cast' with '-analyzer-store=basic-old-cast'. We'll keep the old CastRegion implementation around for a little while for regression testing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@75209 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-06Unbreak build by including header.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74870 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-06Make 'BasicStoreManager' + 'NewCastRegion' testable from the command line ↵Ted Kremenek
using '-analyzer-store=basic-new-cast'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74865 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-06Move the new 'CastRegion' implementation from RegionStoreManager to StoreManagerTed Kremenek
(its superclass). This will allow us to experiment with using the new CastRegion with BasicStoreManager, and gradually phase out the old implementation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74851 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-06Further cleanup of region invalidation code. No functionality change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74816 91177308-0d34-0410-b5e6-96231b3b80d8
2009-07-06Start to gradually move region invalidation code into store manager.Zhongxing Xu
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74812 91177308-0d34-0410-b5e6-96231b3b80d8
2009-06-26Introduce a new concept to the static analyzer: SValuator.Ted Kremenek
GRTransferFuncs had the conflated role of both constructing SVals (symbolic expressions) as well as handling checker-specific logic. Now SValuator has the role of constructing SVals from expressions and GRTransferFuncs just handles checker-specific logic. The motivation is by separating these two concepts we will be able to much more easily create richer constraint-generating logic without coupling it to the main checker transfer function logic. We now have one implementation of SValuator: SimpleSValuator. SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals (which is removed in this patch). This includes the logic for EvalBinOp, EvalCast, etc. Because SValuator has a narrower role than the old GRTransferFuncs, the interfaces are much simpler, and so is the implementation of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of SVal-related logic in GRSimpleVals and cleaned it up while moving it over to SimpleSValuator. As a consequence of removing GRSimpleVals, there is no longer a '-checker-simple' option. The '-checker-cfref' did everything that option did but also ran the retain/release checker. Of course a user may not always wish to run the retain/release checker, nor do we wish core analysis logic buried in the checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp to separate out these pieces into the core analysis engine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74229 91177308-0d34-0410-b5e6-96231b3b80d8
2009-06-24Remove uses of std::ostream from libAnalysis.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@74136 91177308-0d34-0410-b5e6-96231b3b80d8
2009-06-17Start moving in the direction of removing GRStateRef. Now eachTed Kremenek
GRState object has a direct reference to its GRStateManager, making the functionality of GRStateRef redunandant. This will lead to some nice API cleanup and code shrinking across libAnalysis. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@73644 91177308-0d34-0410-b5e6-96231b3b80d8
2009-06-16RegionStoreManager:Ted Kremenek
- Add "sections" to RegionStoreManager.cpp to delineate functionality. - Add new function "CreateFieldsOnlyRegionStoreManager" that uses the new RegionStoreFeatures class to use a reduced set of features from RegionStoreManager (in this case, only field-sensitivity). This isn't completely hooked up yet. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@73572 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-20* API change: we need to pass GRState to GRExprEngine::EvalBinOp() becauseZhongxing Xu
RegionStore needs to know the type of alloca region. * RegionStoreManager::EvalBinOp() now converts the alloca region to its first element region, as what is done to symbolic region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@72164 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-12Add logic for invalidating array region to CFRefCount.cpp. When invalidatingZhongxing Xu
array region, set its default value to conjured symbol. When retrieving its element, create new region value symbol for the element. Also fix some 80 columns violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@71548 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-06Make StoreManager::CastRegion() virtual and implement a new CastRegion() forZhongxing Xu
RegionStore. This CastRegion() performs casts according to the kind of the region being cast instead of the type that is cast to. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@71058 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04Per conversations with Zhongxing, add an 'element type' toTed Kremenek
ElementRegion. I also removed 'ElementRegion::getArrayRegion', although we may need to add this back. This breaks a few test cases with RegionStore: - 'array-struct.c' triggers an infinite recursion in RegionStoreManager. Need to investigate. - misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic: 'Line 159: Uninitialized or undefined return value returned to caller.' There were a bunch of places that needed to be edit RegionStoreManager, and we may not be passing all the correct 'element types' down from GRExprEngine. Zhongxing: When you get a chance, could you review this? I could have easily screwed up something basic in RegionStoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70830 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-21Refactor 'BasicStoreManager::CastRegion' and 'RegionStoreManager::CastRegion'Ted Kremenek
into StoreManager::CastRegion. Both methods were practically identical, and this is core logic that is common to all StoreManagers since it defines the basic invariants of the abstract memory model. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@69730 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09- Move ownership of MemRegionManager into ValueManager.Ted Kremenek
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly simplifies the calling interface to clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05BasicStore:Ted Kremenek
- Store bindings using a MemRegion -> SVal binding instead of VarDecl -> SVal binding. This mirrors some of the idea of RegionStore, but is far simpler and not nearly as functional. This leads to some code simplification and some potential for some minor precision hacks. Along the way... - constify the use of MemRegion* in a few places - add operator<<(llvm::raw_ostream, const MemRegion*) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66163 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Don't use std::auto_ptr with getSubRegionMap().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65957 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning ↵Ted Kremenek
MemRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65919 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Add StoreManager::getSubRegionMap(). This method returns an opaque mapping ↵Ted Kremenek
for clients of StoreManagers from MemRegions to their subregions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65914 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-02 23:31:19 +0000