aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive
AgeCommit message (Collapse)Author
2009-03-11The RValueType of a TypedViewRegion should be the pointee type.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66655 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Add utility method to BasicValueFactory to convert an APSInt to one of a ↵Ted Kremenek
different sign. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66637 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Add accessor method.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66626 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Add accessor method to return a GRStateManager's internal ConstraintManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66625 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Added method "canReasonAbout" to ConstraintManager. This method returns true ifTed Kremenek
a ConstraintManager can usefully reason about the given SVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66624 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Add some iterators to BugReporter.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66621 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-09Add member template "MemRegion::getAs<RegionType>" that dynamically casts aTed Kremenek
given MemRegion object to a target region type. This differs from dyn_cast<> in that it also ignores TypedViewRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66439 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05BasicStore:Ted Kremenek
- Store bindings using a MemRegion -> SVal binding instead of VarDecl -> SVal binding. This mirrors some of the idea of RegionStore, but is far simpler and not nearly as functional. This leads to some code simplification and some potential for some minor precision hacks. Along the way... - constify the use of MemRegion* in a few places - add operator<<(llvm::raw_ostream, const MemRegion*) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66163 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04MemRegion:Ted Kremenek
- Have 'TypedRegion::getRValueType()' return a null QualType for 'id<...>' instead of aborting. - Change 'TypedRegion::isBoundable()' to return true for all objects with a non-null RValueType (this may not be the final behavior). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66093 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Add an optional "tag" to conjured symbols that allows us to distinguish betweenTed Kremenek
multiple symbols conjured at the same location. All that is required of the tag is that it is a fixed void* value that points to an memory address that remains valid throughout the remainder of the lifetime of the SymbolManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66092 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Added the notion of a "boundable region", which is a region that can have a ↵Ted Kremenek
direct binding in the StoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66005 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Add "GetSValAsScalarOrLoc" methods to GRState/GRStateRef that only perform aTed Kremenek
retrieval from the store/environment for locations or scalar types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65982 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Rework use of loc::SymbolVal in the retain/release checker to use the new methodTed Kremenek
SVal::getAsLocSymbol(). This simplifies the code and allows the retain/release checker to (I believe) also correctly reason about location symbols wrapped in SymbolicRegions. Along the way I cleaned up SymbolRef a little, disallowing implicit casts to 'unsigned'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65972 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Don't use std::auto_ptr with getSubRegionMap().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65957 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning ↵Ted Kremenek
MemRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65919 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Add StoreManager::getSubRegionMap(). This method returns an opaque mapping ↵Ted Kremenek
for clients of StoreManagers from MemRegions to their subregions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65914 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-02Initial support for pointer arithmetic. Only support concrete indexes and Zhongxing Xu
offsets for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65814 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-01Rename AnonTypedRegion to TypedViewRegion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65764 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-26Create a new TypeNodes.def file that enumerates all of the types,Douglas Gregor
giving them rough classifications (normal types, never-canonical types, always-dependent types, abstract type representations) and making it far easier to make sure that we've hit all of the cases when decoding types. Switched some switch() statements on the type class over to using this mechanism, and filtering out those things we don't care about. For example, CodeGen should never see always-dependent or non-canonical types, while debug info generation should never see always-dependent types. More switch() statements on the type class need to be moved over to using this approach, so that we'll get warnings when we add a new type then fail to account for it somewhere in the compiler. As part of this, some types have been renamed: TypeOfExpr -> TypeOfExprType FunctionTypeProto -> FunctionProtoType FunctionTypeNoProto -> FunctionNoProtoType There shouldn't be any functionality change... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65591 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Fix subtle bug in EvalEagerlyAssume: Check if the previous node was at the ↵Ted Kremenek
same statement. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65486 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Add experimental logic in GRExprEngine::EvalEagerlyAssume() to handleTed Kremenek
expressions of the form: 'short x = (y != 10);' While we handle 'int x = (y != 10)' lazily, the cast to another integer type currently loses the symbolic constraint. Eager evaluation of the constraint causes the paths to bifurcate and eagerly evaluate 'y != 10' to a constant of 1 or 0. This should address <rdar://problem/6619921> until we have a better (more lazy approach) for handling promotions/truncations of symbolic integer values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65480 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Implement 'Add' method for GRStatePartialTrait<ImmutableList<T>>.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65424 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-19Added a new method to GRStmtNodeBuilder to build nodes using an arbitraryTed Kremenek
PostStmt program point. This allows clients to pass in PostStmtCustom program points. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65080 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-19Implemented simple check in <rdar://problem/6600344>: When the receiver of aTed Kremenek
message expression is nil and the return type is struct then the returned value is undefined or potentially garbage. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65003 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-18Hooked up the necessary machinery to allow the retain/release checker referenceTed Kremenek
back to the summary used when evaluating the statement associated with a simulation node. This is now being used to help improve the checker's diagnostics. To get things started, the checker now emits a path diagnostic indicating that 'autorelease' is a no-op in GC mode. Some of these changes are exposing further grossness in the interface between BugReporter and the ExplodedGraph::Trim facilities. These really need to be cleaned up one day. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64881 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17BasicValueFactory: getMinValue/getMaxValue can be applied to any location ↵Ted Kremenek
type as specified by Loc::IsLocType(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64832 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17BasicValueFactory: getMaxValue and getMinValue now also handle 'block' pointers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64786 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-16Modify getMaxValue/getMinValue to take pointer values as well.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64682 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-16BasicValueFactory: Add utility methods 'Add1' and 'Sub1' to get a persistent ↵Ted Kremenek
APSInt value that is 1 greater or 1 less than the provided value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64678 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-16BasicValueFactory: Add getMaxValue and getMinValue variants that take QualTypes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64677 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-16Add getSymbolManager() and getBasicVals() accessors to GRStateRef.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64675 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Patch by Ben Laurie:Ted Kremenek
ConstraintManager: - constify getSymVal() BasicConstraintManager: - Pull out logic that would be common to ConstraintManagers of a similar nature and put them in a parent class called 'SimpleConstraintManager'. RangeConstraintManager: - Added a new prototype ConstraintManager to track ranges of variables! This ConstraintManager keeps tracks of ranges of concrete integers that a symbolic integer may have. AnalysisConsumer: - Add driver option to use RangeConstraintManager with GRExprEngine-based analyses. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64558 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Added GRStateManager::scanReachableSymbols(), a method which scans the reachableTed Kremenek
symbols from an SVal. - Fixed a bug in EnvironmentManager::RemoveDeadBindings() where it did not mark live all the symbols reachable from a live block-level expression. - Fixed a bug in the retain/release checker where it did not stop tracking symbols that 'escaped' via compound literals being assigned to something the BasicStoreManager didn't reason about. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64534 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Static analyzer:Ted Kremenek
- Added a new 'node builder' class called GRStmtNodeBuilderRef (name may change). This is essentially a smart reference to a GRStmtNodeBuilder object that keeps track of the current context (predecessor node, GRExprEngine object, etc.) The idea is to gradually simplify the interface between GRExprEngine and GRTransferFuncs using this new builder (i.e., passing 1 argument instead of 5). It also handles some of the "auto-transition" for node creation, simplifying some of the logic in GRExprEngine itself. - Used GRStmtBuilderRef to replace GRTransferFuncs::EvalStore with GRTransferFuncs::EvalBind. The new EvalBind method will be used at any arbitrary places where a binding between a location and value takes place. Moreover, GRTransferFuncs no longer has the responsibility to request StoreManager to do the binding; this is now in GRExprEngine::EvalBind. All GRTransferFuncs::EvalBind does is checker-specific logic (which can be a no-op). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64525 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-13GRExprEngine:Ted Kremenek
- Add 'EvalBind', which will be used by 'EvalStore' to pull much of the value binding logic out of GRTransferFuncs. - Rename many cases of 'St' to 'state'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64426 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-07Commit header.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64042 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so Zhongxing Xu
do the symblic regions associated with them and we need them to be typed. Current SymbolicRegion::getRValueType() method is very restricting. It may be modified when we are more clear about what could be the types of symblic regions. BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a subclass of SubRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63844 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Overhaul BugReporter interface and implementation. The new interface cleans upTed Kremenek
the ownership of BugTypes and BugReports. Now BugReports are owned by BugTypes, and BugTypes are owned by the BugReporter object. The major functionality change in this patch is that reports are not immediately emitted by a call to BugReporter::EmitWarning (now called EmitReport), but instead of queued up in report "equivalence classes". When BugReporter::FlushReports() is called, it emits one diagnostic per report equivalence class. This provides a nice cleanup with the caching of reports as well as enables the BugReporter engine to select the "best" path for reporting a path-sensitive bug based on all the locations in the ExplodedGraph that the same bug could occur. Along with this patch, Leaks are now coalesced into a common equivalence class by their allocation site, and the "summary" diagnostic for leaks now reports the allocation site as the location of the bug (this may later be augmented to also provide an example location where the leak occurs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63796 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63715 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-30Move method out-of-line.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63412 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-30Fix a couple bugs:Ted Kremenek
- NonLoc::MakeVal() would use sizeof(unsigned) (literally) instead of consulting ASTContext for the size (in bits) of 'int'. While it worked, it was a conflation of concepts and using ASTContext.IntTy is 100% correct. - RegionStore::getSizeInElements() no longer assumes that a VarRegion has the type "ConstantArray", and handles the case when uses use ordinary variables as if they were arrays. - Fixed ElementRegion::getRValueType() to just return the rvalue type of its "array region" in the case the array didn't have ArrayType. - All of this fixes <rdar://problem/6541136> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63347 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Remove method 'AddNE' from the public interface of ConstraintManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63249 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Add some comments to GRStateManager. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63243 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-24More hacking on static analyzer diagnostics. When emitting summary ↵Ted Kremenek
diagnostics the code paths for diagnostics involving paths or single locations are now unified. This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62903 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-23Added virtual method DiagnosticClient::IncludeInDiagnosticCounts(). This is ↵Ted Kremenek
used by Diagnostics to determine if a diagnostic sent to a given DiagnosticClient should be included in the count of diagnostics. The default implementation of this method returns 'true'. Implemented DiagCollector::IncludeInDiagnosticCounts() to return 'false' so that the batching of diagnostics for use with BugReporter doesn't mess up the count of real diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62873 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-22Static analyzer: Remove a bunch of outdated SymbolData objects andTed Kremenek
their associated APIs. We no longer need separate SymbolData objects for fields, variables, etc. Instead, we now associated symbols with the "rvalue" of a MemRegion (i.e., the value stored at that region). Now we only have two kinds of SymbolData objects: SymbolRegionRValue and SymbolConjured. This cleanup also makes the distinction between a SymbolicRegion and a symbolic value that is a location much clearer. A SymbolicRegion represents a chunk of symbolic memory, while a symbolic location is just a "pointer" with different possible values. Without any specific knowledge, a symbolic location resolves (i.e., via a dereference) to a SymbolicRegion. In the future, when we do better alias reasoning, a symbolic location can become an alias for another location, thus merging the constraints on the referred SymbolicRegion with the other region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62769 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-13static analyzer: Handle casts from arrays to integers. This fixes PR 3297.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62130 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-08Add isSubRegionOf() method to SubRegion.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61924 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Update some doxygen comments to be more rich. Remove ↵Ted Kremenek
StoreManager::GetRegionSVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61894 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-10 08:17:31 +0000