aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-22Process cast according to the cast kind. Prepare for more specific cast Zhongxing Xu
handling (for C++). No functionality change for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94153 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-21Speed up compilation by avoiding generating exceptional edges fromMike Stump
CallExprs as those edges help cause a n^2 explosion in the number of destructor calls. Other consumers, such as static analysis, that would like to have more a more complete CFG can select the inclusion of those edges as CFG build time. This also fixes up the two compilation users of CFGs to be tolerant of having or not having those edges. All catch code is assumed be to live if we didn't generate the exceptional edges for CallExprs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94074 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-19Fix a serious bug: Tmp3 is the wrong destination set. We should create a newZhongxing Xu
intermediate destination set Tmp4. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93873 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-18Add support for computing size in elements for symbolic regions obtained fromZhongxing Xu
malloc(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93722 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-15Convert a few more uses of std::string& to llvm::StringRef.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93506 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-11Avoid use of deprecated functions (CStrInCStrNoCase and StringsEqualNoCase).Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93175 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-11Switch RegionStore over to using <BaseRegion+raw offset> to storeTed Kremenek
value bindings. Along with a small change to OSAtomicChecker, this resolves <rdar://problem/7527292> and resolves some long-standing issues with how values can be bound to the same physical address by not have the same "key". This change is only a beginning; logically RegionStore needs to better handle loads from addresses where the stored value is larger/smaller/different type than the loaded value. We handle these cases in an approximate fashion now (via CastRetrievedVal and help in SimpleSValuator), but it could be made much smarter. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93137 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09When binding an rvalue to a reference, create a temporary object. Use Zhongxing Xu
CXXObjectRegion to represent it. In Environment, lookup a literal expression before make up a value for it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93047 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Make static analysis support for C++ 'this' expression context-sensitive. ↵Ted Kremenek
Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92675 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Remove references to 'Checker' and 'GRTransferFuncs' fromTed Kremenek
GRStateManager. Having these references was an abstraction violation, as they really should only be known about GRExprEngine. This change required adding a new 'ProcessAssume' callback in GRSubEngine. GRExprEngine implements this callback by calling 'EvalAssume' on all registered Checker objects as well as the registered GRTransferFunc object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92549 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-31Let constraint manager inform checkers that some assumption logic has happend.Zhongxing Xu
Add new states for symbolic regions tracked by malloc checker. This enables us to do malloc checking more accurately. See test case. Based on Lei Zhang's patch and discussion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24As Ted suggested, record the callsite information with the StackFrameContext.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92121 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Inter-procedural analysis: now we can return from the callee.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92116 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a SwitchStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92102 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Migrate the call inliner to the Checker interface.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91991 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add CFG support for the condition variable that can appear in IfStmts in C++ ↵Ted Kremenek
mode. Add transfer function support in GRExprEngine for IfStmts with initialized condition variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91987 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add assertion to check for valid source ranges.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91966 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add basic support for analyzing CastExprs as lvalues.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91952 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-22Add transfer functions support for visiting an Objective-C message ↵Ted Kremenek
expression as an lvalue when the return type is a C++ reference. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91926 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-19Remove ';' after method definition. Noticed by clang++, which one would thinkDaniel Dunbar
would have a higher respect for its own code. This is getting old, is this warning really adding value? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91779 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-18Enhance GRExprEngine::VisitCallExpr() to be used in an lvalue context. ↵Ted Kremenek
Uncovered a new failing test case along the way, but we're making progress on handling C++ references in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91710 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Convert GRExprEngine::VisitCallExpr() to use a worklist instead of recursion ↵Ted Kremenek
to evaluate the arguments of a CallExpr. This simplifies the logic and makes it easier to read. (it also avoids any issues with blowing out the stack if the CallExpr had a ridiculous number of arguments) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91613 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Completely remove ObjCObjectRegion (tests pass this time).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91572 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu
attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91535 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91517 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Teach CheckerVisitor about CXXOperatorCallExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91509 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Make GRSubEngine.h standaloneDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91504 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add (initial?) static analyzer support for handling C++ references.Ted Kremenek
This change was a lot bigger than I originally anticipated; among other things it requires us storing more information in the CFG to record what block-level expressions need to be evaluated as lvalues. The big change is that CFGBlocks no longer contain Stmt*'s by CFGElements. Currently CFGElements just wrap Stmt*, but they also store a bit indicating whether the block-level expression should be evalauted as an lvalue. DeclStmts involving the initialization of a reference require us treating the initialization expression as an lvalue, even though that information isn't recorded in the AST. Conceptually this change isn't that complicated, but it required bubbling up the data through the CFGBuilder, to GRCoreEngine, and eventually to GRExprEngine. The addition of CFGElement is also useful for when we want to handle more control-flow constructs or other data we want to keep in the CFG that isn't represented well with just a block of statements. In GRExprEngine, this patch introduces logic for evaluating the lvalues of references, which currently retrieves the internal "pointer value" that the reference represents. EvalLoad does a two stage load to catch null dereferences involving an invalid reference (although this could possibly be caught earlier during the initialization of a reference). Symbols are currently symbolicated using the reference type, instead of a pointer type, and special handling is required creating ElementRegions that layer on SymbolicRegions (see the changes to RegionStoreManager). Along the way, the DeadStoresChecker also silences warnings involving dead stores to references. This was the original change I introduced (which I wrote test cases for) that I realized caused GRExprEngine to crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91501 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-15Remove ValueManager::getRegionValueSymbolValOrUnknown(). It was just extra ↵Ted Kremenek
veneer on top of getRegionValueSymbolVal(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91471 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-15Remove displayProgress parameter.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91429 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-14Fix: <rdar://problem/7468209> SymbolManager::isLive() should not crash on ↵Ted Kremenek
captured block variables that are passed by reference git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91348 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-12Add initial support for realloc() in MallocChecker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91216 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-11Enhance understanding of VarRegions referenced by a block whose declarations ↵Ted Kremenek
are outside the current stack frame. Fixes <rdar://problem/7462324>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91107 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Refactor OSAtomic evaluation logic into OSAtomicChecker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90968 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-08Make the BugType.h header self-contained so Daniel will stop bugging me ;)Anders Carlsson
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90887 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add analysis support for blocks. This includes a few key changes:Ted Kremenek
- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters. - VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference) - Add transfer function support to GRExprEngine for BlockDeclRefExprs. This change also supports analyzing blocks as an analysis entry point (top-of-the-stack), which required pushing more context-sensitivity around in the MemRegion hierarchy via the use of LocationContext objects. Functionally almost everything is the same, except we track LocationContexts in a few more areas and StackSpaceRegions now refer to a StackFrameContext object. In the future we will need to modify MemRegionManager to allow multiple StackSpaceRegions in flight at once (for the analysis of multiple stack frames). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90809 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add EvalCallExpr interface to checker, and migrate the no-return functionZhongxing Xu
handler to this interface. GRExprEngine::CheckerEvalCall() will return true if one of the checkers has processed the node. In the future this might return void when we have some default checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90755 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Replace SymbolReaper::isLive(VarDecl) with SymbolReaper::isLive(VarRegion).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90582 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Rename instance variable to avoid name conflict with parameters, and modify ↵Ted Kremenek
addTransition() to compare the correct state values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90552 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Revert r90546.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90551 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04the assertion says state is not NULL. When state is not NULL, getState() Zhongxing Xu
returns state. So simplify the predicate. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90546 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Allow BlockInvocationContext to wrap either a BlockDecl* or a ↵Ted Kremenek
BlockDataRegion*, giving us choice in our degree of context-sensitivity. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90516 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Refactor LocationContext creation logic into a single member template.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90509 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04Refactor FoldingSet profiling code for LocationContexts, and add a new ↵Ted Kremenek
BlockInvocationContext to represent the invocation of a block. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90506 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04constify MemRegion* returned by MemRegionManager::getXXXRegion() methods.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90503 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-04More template-logic for MemRegion construction out of MemRegion.h and into ↵Ted Kremenek
MemRegion.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90499 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-03Make BlockDataRegion::referenced_vars_iterator an actual class that enforces ↵Ted Kremenek
that all MemRegions iterated over are VarRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90430 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-03Add batch version of 'StoreManager::InvalidateRegion()' for invalidating ↵Ted Kremenek
multiple regions as once. After adopting this in the CFRefCount::EvalCall(), we see a reduction in analysis time of 1.5% when analyzing all of SQLite3. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90405 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-02Hard bifurcate the state into nil receiver and non-nil receiver, so thatZhongxing Xu
we don't need to use the DoneEvaluation hack when check for ObjCMessageExpr. PreVisitObjCMessageExpr() only checks for undefined receiver or arguments. Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90296 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-04-30 22:43:53 +0000